gh0strat | bdd93c105d232a45c81441c0f002cf3f0f9a39f738f6554714adf8157980d500

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 18:30

Target

bdd93c105d232a45c81441c0f002cf3f0f9a39f738f6554714adf8157980d500.dll
Size

899KB
MD5

9c1ba274cecaf23d6934593fbbab5d68
SHA1

7ca571d5e7289bc281fd4b4e69f3166ac9298595
SHA256

bdd93c105d232a45c81441c0f002cf3f0f9a39f738f6554714adf8157980d500
SHA512

725ef88521502df67509f248a32598c0a6dedf26807726b3d841ae9960f1c79878f311baeb1027d7ae0b6f44179683cf3a9980b0fcbe9338b42bacfbf1b6a904
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX+:7wqd87V+

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3608-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3608	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 3608	3596	rundll32.exe	85
PID 3596 wrote to memory of 3608	3596	rundll32.exe	85
PID 3596 wrote to memory of 3608	3596	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdd93c105d232a45c81441c0f002cf3f0f9a39f738f6554714adf8157980d500.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdd93c105d232a45c81441c0f002cf3f0f9a39f738f6554714adf8157980d500.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3608

memory/3608-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download