gh0strat | 6d1228549c31d7b186d00195755ebb24040ca146aae411f7b70ee9515643af86

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 22:54

Target

6d1228549c31d7b186d00195755ebb24040ca146aae411f7b70ee9515643af86.dll
Size

899KB
MD5

149715bbe16329e08d2c1fbc5ba0ad9c
SHA1

110069d0025464b0998f2e825f0dcbaad39d760a
SHA256

6d1228549c31d7b186d00195755ebb24040ca146aae411f7b70ee9515643af86
SHA512

3f1289763724f211d34a24de1e4f7114ce5b1c2bac65b48d36d4f7c5f5c26d9bc26bdda4f04373c940c3b1d9f2c1cb520c34bde40d736a8f6dacc31c2e75cea2
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXx:7wqd87Vx

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2316-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2316 rundll32.exe

pid	process
2316	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2284 wrote to memory of 2316	2284	rundll32.exe	rundll32.exe
PID 2284 wrote to memory of 2316	2284	rundll32.exe	rundll32.exe
PID 2284 wrote to memory of 2316	2284	rundll32.exe	rundll32.exe
PID 2284 wrote to memory of 2316	2284	rundll32.exe	rundll32.exe
PID 2284 wrote to memory of 2316	2284	rundll32.exe	rundll32.exe
PID 2284 wrote to memory of 2316	2284	rundll32.exe	rundll32.exe
PID 2284 wrote to memory of 2316	2284	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d1228549c31d7b186d00195755ebb24040ca146aae411f7b70ee9515643af86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d1228549c31d7b186d00195755ebb24040ca146aae411f7b70ee9515643af86.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2316

memory/2316-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download