gh0strat | 27348b73e5141801f026e39c825c80132e7a6d135dcfa2767f098a7f9f8cf423

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 20:43

Target

27348b73e5141801f026e39c825c80132e7a6d135dcfa2767f098a7f9f8cf423.dll
Size

899KB
MD5

1261d1f6dd6219d3b6c03105c332f352
SHA1

8642ed9bad1aa28abefa963502f793ad795e57ed
SHA256

27348b73e5141801f026e39c825c80132e7a6d135dcfa2767f098a7f9f8cf423
SHA512

237642a3d9a2cb5d28fd5cb2ad1d5909c56e1273484e1818f7045cde4f6d3b76210f02832fdbd187212c91ddb5da78f2814edc998a12993a1e8057fcc0fb2c49
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXm:7wqd87Vm

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2972-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2972	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2972	2748	rundll32.exe	28
PID 2748 wrote to memory of 2972	2748	rundll32.exe	28
PID 2748 wrote to memory of 2972	2748	rundll32.exe	28
PID 2748 wrote to memory of 2972	2748	rundll32.exe	28
PID 2748 wrote to memory of 2972	2748	rundll32.exe	28
PID 2748 wrote to memory of 2972	2748	rundll32.exe	28
PID 2748 wrote to memory of 2972	2748	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27348b73e5141801f026e39c825c80132e7a6d135dcfa2767f098a7f9f8cf423.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27348b73e5141801f026e39c825c80132e7a6d135dcfa2767f098a7f9f8cf423.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2972

memory/2972-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download