gh0strat | 7ae524e50641368c4d3b91d4dc88d3ab3e623bc8cea840ed17b0bd1c6f862297

Analysis

max time kernel
147s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:32

Target

7ae524e50641368c4d3b91d4dc88d3ab3e623bc8cea840ed17b0bd1c6f862297.dll
Size

50KB
MD5

fd3585893383089b9de310a4e805a273
SHA1

8582828ba6f93a9c42e075a9a6242bd66ffa4dd3
SHA256

7ae524e50641368c4d3b91d4dc88d3ab3e623bc8cea840ed17b0bd1c6f862297
SHA512

eb84ebdf6434f17b5837f4a662051d231a591a3a45c4e1e8992e4ff631eb6a871ae183abe45677e48d18864e02084b5f2863cf99f99aac8b7037c07dfa5ac68b
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5rJYH:W5ReWjTrW9rNPgYolJYH

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4920-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

4920 rundll32.exe

pid	process
4920	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1220 wrote to memory of 4920	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 4920	1220	rundll32.exe	rundll32.exe
PID 1220 wrote to memory of 4920	1220	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ae524e50641368c4d3b91d4dc88d3ab3e623bc8cea840ed17b0bd1c6f862297.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ae524e50641368c4d3b91d4dc88d3ab3e623bc8cea840ed17b0bd1c6f862297.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:4920

memory/4920-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download