gh0strat | 48343fdf20e634304b81ef74bb9d77af2d7bbe4bf83f244263dab8a7760e3f5d

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 08:21

Target

48343fdf20e634304b81ef74bb9d77af2d7bbe4bf83f244263dab8a7760e3f5d.dll
Size

51KB
MD5

50d9d39b2eae9b641c8823bd5f4fa199
SHA1

df77bd8dc22698f005b6e6a441ea2f8db80a560c
SHA256

48343fdf20e634304b81ef74bb9d77af2d7bbe4bf83f244263dab8a7760e3f5d
SHA512

16672e7e7850f98c08b2c86d72063ba3ae0502b977c44a9c35bb0d6a4e9ec6fc15fd410df8913e2232f5d845ec7154908a295b9dafdfaa39f7229ef945031d22
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLzJYH5:1dWubF3n9S91BF3fboHJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2972-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2972 rundll32.exe

pid	process
2972	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2868 wrote to memory of 2972	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2972	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2972	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2972	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2972	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2972	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2972	2868	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48343fdf20e634304b81ef74bb9d77af2d7bbe4bf83f244263dab8a7760e3f5d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48343fdf20e634304b81ef74bb9d77af2d7bbe4bf83f244263dab8a7760e3f5d.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2972

memory/2972-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download