gh0strat | 5e9441e494dcceb1f1d99a6656079c056f4d6eb2ab9800ef478f8b90440caa73

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 15:32

Target

5e9441e494dcceb1f1d99a6656079c056f4d6eb2ab9800ef478f8b90440caa73.dll
Size

51KB
MD5

6bbbce14dd9ae7645cb8055fe8ee9f57
SHA1

d06b02d4e253e9f1ef4dd55b8b4a6d1a18a17d73
SHA256

5e9441e494dcceb1f1d99a6656079c056f4d6eb2ab9800ef478f8b90440caa73
SHA512

f02d9dee2ebd67e68f493a021e5393fb86738210e2d26fcfe6160dc790bd188482d2d96a6c2981677f52523638458c0e5c82ad8a4225173e13687e0f91bd9c94
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLiJYH5:1dWubF3n9S91BF3fbouJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2968-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2968	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2968	2872	rundll32.exe	28
PID 2872 wrote to memory of 2968	2872	rundll32.exe	28
PID 2872 wrote to memory of 2968	2872	rundll32.exe	28
PID 2872 wrote to memory of 2968	2872	rundll32.exe	28
PID 2872 wrote to memory of 2968	2872	rundll32.exe	28
PID 2872 wrote to memory of 2968	2872	rundll32.exe	28
PID 2872 wrote to memory of 2968	2872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e9441e494dcceb1f1d99a6656079c056f4d6eb2ab9800ef478f8b90440caa73.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e9441e494dcceb1f1d99a6656079c056f4d6eb2ab9800ef478f8b90440caa73.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2968

memory/2968-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download