gh0strat | e5e0fa93c547480d7a5c3f456b2f43041e07251303f3a02d0173f46c47c175a0

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 23:20

Target

e5e0fa93c547480d7a5c3f456b2f43041e07251303f3a02d0173f46c47c175a0.dll
Size

51KB
MD5

5d805b78504230a375920d7626102ade
SHA1

8780a1a3a8c13c6eba21050f63ef19a630d67d6f
SHA256

e5e0fa93c547480d7a5c3f456b2f43041e07251303f3a02d0173f46c47c175a0
SHA512

eecef6570796dd24bb205163e63f29437384d8c314c2abf2be1befa7c4bd734c92e4c5f3cfb5fb1670f3f98a56efa4fb336df3cb88bae0d3b954f7b666ceadae
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLJJYH5:1dWubF3n9S91BF3fbo1JYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1800-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1800	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1800	1992	rundll32.exe	28
PID 1992 wrote to memory of 1800	1992	rundll32.exe	28
PID 1992 wrote to memory of 1800	1992	rundll32.exe	28
PID 1992 wrote to memory of 1800	1992	rundll32.exe	28
PID 1992 wrote to memory of 1800	1992	rundll32.exe	28
PID 1992 wrote to memory of 1800	1992	rundll32.exe	28
PID 1992 wrote to memory of 1800	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5e0fa93c547480d7a5c3f456b2f43041e07251303f3a02d0173f46c47c175a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5e0fa93c547480d7a5c3f456b2f43041e07251303f3a02d0173f46c47c175a0.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1800

memory/1800-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download