gh0strat | e5e0fa93c547480d7a5c3f456b2f43041e07251303f3a02d0173f46c47c175a0

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:20

Target

e5e0fa93c547480d7a5c3f456b2f43041e07251303f3a02d0173f46c47c175a0.dll
Size

51KB
MD5

5d805b78504230a375920d7626102ade
SHA1

8780a1a3a8c13c6eba21050f63ef19a630d67d6f
SHA256

e5e0fa93c547480d7a5c3f456b2f43041e07251303f3a02d0173f46c47c175a0
SHA512

eecef6570796dd24bb205163e63f29437384d8c314c2abf2be1befa7c4bd734c92e4c5f3cfb5fb1670f3f98a56efa4fb336df3cb88bae0d3b954f7b666ceadae
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLJJYH5:1dWubF3n9S91BF3fbo1JYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4988-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

4988 rundll32.exe

pid	process
4988	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 632 wrote to memory of 4988	632	rundll32.exe	rundll32.exe
PID 632 wrote to memory of 4988	632	rundll32.exe	rundll32.exe
PID 632 wrote to memory of 4988	632	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5e0fa93c547480d7a5c3f456b2f43041e07251303f3a02d0173f46c47c175a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:632

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e5e0fa93c547480d7a5c3f456b2f43041e07251303f3a02d0173f46c47c175a0.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:4988

memory/4988-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download