gh0strat | b22a0572af1b6f579fc152a205afe5d2bbe5f0c6227bcc50771335dda33acf6d

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 22:47

Target

b22a0572af1b6f579fc152a205afe5d2bbe5f0c6227bcc50771335dda33acf6d.dll
Size

899KB
MD5

31ae474d73ff0418c6f7cb7a1a02b45a
SHA1

610e43ad68366dd863510b86ac4a48507b5ae2c2
SHA256

b22a0572af1b6f579fc152a205afe5d2bbe5f0c6227bcc50771335dda33acf6d
SHA512

017d060e89fe1bce832197a916c4f2e381870b588c810ecd806828024daeda4c4485bb5aa9fba58c8250237af05e7b63197d544fa55a7686ebd309cd036794d3
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXs:7wqd87Vs

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2196-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2196 rundll32.exe

pid	process
2196	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2792 wrote to memory of 2196	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2196	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2196	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2196	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2196	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2196	2792	rundll32.exe	rundll32.exe
PID 2792 wrote to memory of 2196	2792	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b22a0572af1b6f579fc152a205afe5d2bbe5f0c6227bcc50771335dda33acf6d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b22a0572af1b6f579fc152a205afe5d2bbe5f0c6227bcc50771335dda33acf6d.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2196

memory/2196-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download