gh0strat | 2daff6fed8ce0c378aae727603d1b896703dd929e8526900652e23998a4aaf41

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 02:42

Target

2daff6fed8ce0c378aae727603d1b896703dd929e8526900652e23998a4aaf41.dll
Size

899KB
MD5

0264a687483222f5fc86e06a20c2d849
SHA1

1b23abba320db6b4c2cafbd8d3b11d06877dc618
SHA256

2daff6fed8ce0c378aae727603d1b896703dd929e8526900652e23998a4aaf41
SHA512

1e32feb4e656a65bfbfd8d93cdad734a5b1fd461d380fde47cc31c20db7df481f15161ac353a34049b2cb50a3984c5482319fed5a95bad079043f377a09525bf
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXn:7wqd87Vn

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2272-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2272	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2272	2816	rundll32.exe	28
PID 2816 wrote to memory of 2272	2816	rundll32.exe	28
PID 2816 wrote to memory of 2272	2816	rundll32.exe	28
PID 2816 wrote to memory of 2272	2816	rundll32.exe	28
PID 2816 wrote to memory of 2272	2816	rundll32.exe	28
PID 2816 wrote to memory of 2272	2816	rundll32.exe	28
PID 2816 wrote to memory of 2272	2816	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2daff6fed8ce0c378aae727603d1b896703dd929e8526900652e23998a4aaf41.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2daff6fed8ce0c378aae727603d1b896703dd929e8526900652e23998a4aaf41.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2272

memory/2272-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download