gh0strat | a21b7b3407ecdb33a3e2d5de26429529dd26c40d924bb915ea89c6f43cf9e626

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 18:31

Target

a21b7b3407ecdb33a3e2d5de26429529dd26c40d924bb915ea89c6f43cf9e626.dll
Size

51KB
MD5

b5efc3993871f34cce117948a0f584aa
SHA1

20b826514f3683459d7d0df12edbaf4a1e2b5a4b
SHA256

a21b7b3407ecdb33a3e2d5de26429529dd26c40d924bb915ea89c6f43cf9e626
SHA512

dbf1c186c2bfa049ca7e82ebe3b27990cf983369d2d823cfe955c362b6b69d761fb6f5f79aef57831fe855c5e94738e76c2d5fc2f07f12dd932c90bea5586caa
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+qJYH5:1dWubF3n9S91BF3fboFJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2412-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2412 rundll32.exe

pid	process
2412	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1596 wrote to memory of 2412	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 2412	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 2412	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 2412	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 2412	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 2412	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 2412	1596	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a21b7b3407ecdb33a3e2d5de26429529dd26c40d924bb915ea89c6f43cf9e626.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a21b7b3407ecdb33a3e2d5de26429529dd26c40d924bb915ea89c6f43cf9e626.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2412

memory/2412-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download