gh0strat | 9dce5b418855b0f9fcc866827589c59016ac400da68a843d5d93d001f46cf9f8

Analysis

max time kernel
140s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:24

Target

9dce5b418855b0f9fcc866827589c59016ac400da68a843d5d93d001f46cf9f8.dll
Size

51KB
MD5

10380cbe342f20e752e52816668446af
SHA1

4b24b2baad22cd9f0b1a30ebf4b46942f7568d6e
SHA256

9dce5b418855b0f9fcc866827589c59016ac400da68a843d5d93d001f46cf9f8
SHA512

e9452a932a76b94f97e985d690728ba9b9b8e7750841b247fb503b8a508f45b37a2069f558d5ad186243ebb6b5a83411934b5d864398c404db7cd5d27f54bfff
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+xJYH5:1dWubF3n9S91BF3fboGJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3968-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

3968 rundll32.exe

pid	process
3968	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4436 wrote to memory of 3968	4436	rundll32.exe	rundll32.exe
PID 4436 wrote to memory of 3968	4436	rundll32.exe	rundll32.exe
PID 4436 wrote to memory of 3968	4436	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9dce5b418855b0f9fcc866827589c59016ac400da68a843d5d93d001f46cf9f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4436

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9dce5b418855b0f9fcc866827589c59016ac400da68a843d5d93d001f46cf9f8.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:3968

memory/3968-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download