gh0strat | 5b0e2f2c1fdf87a0bb10169dfa1f8c5e7a99d7182755042e076c35614c5148af

Analysis

max time kernel
149s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 04:33

Target

5b0e2f2c1fdf87a0bb10169dfa1f8c5e7a99d7182755042e076c35614c5148af.dll
Size

899KB
MD5

127d3425210d52d419092abf846e803d
SHA1

cedbe2e72f3e2d83dbb518d5efe5a9bdbf81fd59
SHA256

5b0e2f2c1fdf87a0bb10169dfa1f8c5e7a99d7182755042e076c35614c5148af
SHA512

2697eacfeba8331adfedb83e91ade2affece6f114db3d2bf50176ba4f020e11644a93293c128af8b94b14602dd01ed273f97a7d0da2036141418d09af4baacfb
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXq:7wqd87Vq

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3556-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

3556 rundll32.exe

pid	process
3556	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2720 wrote to memory of 3556	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 3556	2720	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 3556	2720	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b0e2f2c1fdf87a0bb10169dfa1f8c5e7a99d7182755042e076c35614c5148af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b0e2f2c1fdf87a0bb10169dfa1f8c5e7a99d7182755042e076c35614c5148af.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:3556

memory/3556-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download