gh0strat | 1aa262acc8b133995ce70e484e3fd74494df3c7b08b77abb7474a8db0a2d9460

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 06:33

Target

1aa262acc8b133995ce70e484e3fd74494df3c7b08b77abb7474a8db0a2d9460.dll
Size

899KB
MD5

9950cc811cf67db0ffc8bb99105bf2a7
SHA1

d2af2de946314a09f667216f18ed80509afbc1f3
SHA256

1aa262acc8b133995ce70e484e3fd74494df3c7b08b77abb7474a8db0a2d9460
SHA512

a4c7062879db6404a0c60383358dece30e8a83194b7e4b44a0198b8d016cf128831c632712103963be2f2a1489d3e1299d731480e9d42161dc8155fdbac7b2b1
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX3:7wqd87V3

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2412-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2412	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2412	2256	rundll32.exe	28
PID 2256 wrote to memory of 2412	2256	rundll32.exe	28
PID 2256 wrote to memory of 2412	2256	rundll32.exe	28
PID 2256 wrote to memory of 2412	2256	rundll32.exe	28
PID 2256 wrote to memory of 2412	2256	rundll32.exe	28
PID 2256 wrote to memory of 2412	2256	rundll32.exe	28
PID 2256 wrote to memory of 2412	2256	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1aa262acc8b133995ce70e484e3fd74494df3c7b08b77abb7474a8db0a2d9460.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1aa262acc8b133995ce70e484e3fd74494df3c7b08b77abb7474a8db0a2d9460.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2412

memory/2412-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download