gh0strat | 6138e41d3dc18f77e6c7142cf3167ca711b60866a7f2fb4f2ba47c6d593dface

Analysis

max time kernel
144s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:22

Target

6138e41d3dc18f77e6c7142cf3167ca711b60866a7f2fb4f2ba47c6d593dface.dll
Size

167KB
MD5

1002c423de040422f2ddedac961950ec
SHA1

af93087d4ee6af9ddf84731413f197e9f38c580e
SHA256

6138e41d3dc18f77e6c7142cf3167ca711b60866a7f2fb4f2ba47c6d593dface
SHA512

e6cd8c01157d4cf8af934050c94309e273d9f3dac26af9f4bdb0fee480d58fda8860ee2bc5d9499b50e623e53cd4efba91a3ec30ad76c9236a8294f7f1fcc0bf
SSDEEP

3072:LUDBHy4BBy6eFJrmmIewRxM6JSQTqGd4Pwc3q:L0yB6oJrcRZQcqGywq

Score

10^/10

gh0strat rat

Gh0st RAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4844-0-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral2/memory/4844-2-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral2/memory/4844-3-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral2/memory/4844-4-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral2/memory/4844-5-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 2136 set thread context of 4844 2136 rundll32.exe svchost.exe

description	pid	process	target process
PID 2136 set thread context of 4844	2136	rundll32.exe	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2136 wrote to memory of 4844	2136	rundll32.exe	svchost.exe
PID 2136 wrote to memory of 4844	2136	rundll32.exe	svchost.exe
PID 2136 wrote to memory of 4844	2136	rundll32.exe	svchost.exe
PID 2136 wrote to memory of 4844	2136	rundll32.exe	svchost.exe
PID 2136 wrote to memory of 4844	2136	rundll32.exe	svchost.exe
PID 2136 wrote to memory of 4844	2136	rundll32.exe	svchost.exe
PID 2136 wrote to memory of 4844	2136	rundll32.exe	svchost.exe
PID 2136 wrote to memory of 4844	2136	rundll32.exe	svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2804 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:3592

memory/4844-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4844-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4844-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4844-4-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4844-5-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download