gh0strat | 274fc8dcd8842fbe187252c3921dd1f7f80009895f787bda2d3aa94c54911a9f

Analysis

max time kernel
141s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 04:51

Target

274fc8dcd8842fbe187252c3921dd1f7f80009895f787bda2d3aa94c54911a9f.dll
Size

899KB
MD5

2a4719d017bb798392dc1d4b01e67832
SHA1

58233c466a3f29dab142eb37806d26ec9ec2ff00
SHA256

274fc8dcd8842fbe187252c3921dd1f7f80009895f787bda2d3aa94c54911a9f
SHA512

8cf4b7a1497827c8d7a570606cafbac5a9776dd9dd8c0222aa739035a2f402eb866d3ca130b83811c0bfd126abca3b22101f9520bbe12bb1e8c42be5d59ef095
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXY:7wqd87VY

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4276-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

4276 rundll32.exe

pid	process
4276	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2148 wrote to memory of 4276	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 4276	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 4276	2148	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\274fc8dcd8842fbe187252c3921dd1f7f80009895f787bda2d3aa94c54911a9f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\274fc8dcd8842fbe187252c3921dd1f7f80009895f787bda2d3aa94c54911a9f.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:4276

memory/4276-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download