gh0strat | 54f7700d1864b811066cbe94f1b55a6a3f39901c73cfeb0deb912d17e173128f

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 17:25

Target

54f7700d1864b811066cbe94f1b55a6a3f39901c73cfeb0deb912d17e173128f.dll
Size

899KB
MD5

e8a7ff08102f318a5a703a8664f361f1
SHA1

63cae8810a09c49f960a55614ace5ef012a406b3
SHA256

54f7700d1864b811066cbe94f1b55a6a3f39901c73cfeb0deb912d17e173128f
SHA512

3af6ea9dd41630bf5d2bb5afad9e12c9b8eab225777826407fe50e07524b966d94b69b70cbb3f0ca8f91f34c5138764e2d38b84863f505fd72c3483511518b5a
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXT:7wqd87VT

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2024-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2024 rundll32.exe

pid	process
2024	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1524 wrote to memory of 2024	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2024	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2024	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2024	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2024	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2024	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 2024	1524	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54f7700d1864b811066cbe94f1b55a6a3f39901c73cfeb0deb912d17e173128f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\54f7700d1864b811066cbe94f1b55a6a3f39901c73cfeb0deb912d17e173128f.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2024

memory/2024-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download