gh0strat | 0b311a0238afd0b726d6c1ed34e6243fca2f025eb51151fbdfd3ef10441bd650

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:18

Target

0b311a0238afd0b726d6c1ed34e6243fca2f025eb51151fbdfd3ef10441bd650.dll
Size

51KB
MD5

39bd699011d4bc2d16b43ad3285acf19
SHA1

5882ba05889d7a65c74123f18023791c37f2e497
SHA256

0b311a0238afd0b726d6c1ed34e6243fca2f025eb51151fbdfd3ef10441bd650
SHA512

0f089f1019e2b464372f0c74e1c25178b021b2992eb89d647064cd04ce6c45cbd8133f66a36cbc3e20fb6cd89d7ebec00a8054d8844c753beb0628349dc2e410
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+uJYH5:1dWubF3n9S91BF3fboVJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1384-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1384 rundll32.exe

pid	process
1384	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3636 wrote to memory of 1384	3636	rundll32.exe	rundll32.exe
PID 3636 wrote to memory of 1384	3636	rundll32.exe	rundll32.exe
PID 3636 wrote to memory of 1384	3636	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b311a0238afd0b726d6c1ed34e6243fca2f025eb51151fbdfd3ef10441bd650.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3636

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b311a0238afd0b726d6c1ed34e6243fca2f025eb51151fbdfd3ef10441bd650.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:1384

memory/1384-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download