gh0strat | fa166fc0fcb0dbb98bdeb60c340c54b1999d25180b392adad7141efeafe52b5b

Analysis

max time kernel
144s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 17:17

Target

fa166fc0fcb0dbb98bdeb60c340c54b1999d25180b392adad7141efeafe52b5b.dll
Size

51KB
MD5

dfa172a5a0cd1b2ad4be32308cb10477
SHA1

4a507d49bad5f937139dac6485d2bd8488f3b0e3
SHA256

fa166fc0fcb0dbb98bdeb60c340c54b1999d25180b392adad7141efeafe52b5b
SHA512

62cf0a29330e701214775d16a71b167f312e04290dd0f951dc838e61d8094019d9cf5d74adb32cfb2b9181f8e86869781e7693c69610c22ca466b877e54b0e9b
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frioLTJYH5:1dWubF3n9S91BF3fuoPJYH5

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1568-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1568 rundll32.exe

pid	process
1568	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2996 wrote to memory of 1568	2996	rundll32.exe	rundll32.exe
PID 2996 wrote to memory of 1568	2996	rundll32.exe	rundll32.exe
PID 2996 wrote to memory of 1568	2996	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa166fc0fcb0dbb98bdeb60c340c54b1999d25180b392adad7141efeafe52b5b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa166fc0fcb0dbb98bdeb60c340c54b1999d25180b392adad7141efeafe52b5b.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:1568

memory/1568-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download