gh0strat | fc9bca876882102f640e22184701541606e9902c3ec79199871d8c2ab5c3cb9b

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 08:18

Target

fc9bca876882102f640e22184701541606e9902c3ec79199871d8c2ab5c3cb9b.dll
Size

51KB
MD5

d6b57db1bc3a58b188ff978855e85db8
SHA1

943ce5cf8afce4fd63b97f03785fdc20f8cd4031
SHA256

fc9bca876882102f640e22184701541606e9902c3ec79199871d8c2ab5c3cb9b
SHA512

690b3650a849116cf9dbeda4a977df6d0358fdbfe33de56cf1698d85041c437f372aa32d114b1089d39fe30f1bba70c1d5a05731b5b07ee3e788e24928a2d05a
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLAJYH5:1dWubF3n9S91BF3fboEJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2192-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2192 rundll32.exe

pid	process
2192	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2348 wrote to memory of 2192	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 2192	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 2192	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 2192	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 2192	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 2192	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 2192	2348	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc9bca876882102f640e22184701541606e9902c3ec79199871d8c2ab5c3cb9b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc9bca876882102f640e22184701541606e9902c3ec79199871d8c2ab5c3cb9b.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2192

memory/2192-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download