gh0strat | d607b25b2a365015cafa1ac0bd314fc61762732b9947ac4463348df8c36e3e4c

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 17:51

Target

d607b25b2a365015cafa1ac0bd314fc61762732b9947ac4463348df8c36e3e4c.dll
Size

51KB
MD5

6255031311efe55ceccb630185e06ad5
SHA1

f871f81f273edb45e8215e544379b0aa7a4b5be3
SHA256

d607b25b2a365015cafa1ac0bd314fc61762732b9947ac4463348df8c36e3e4c
SHA512

1189b5ec0e32a6e2dd6371309d51651215e15341b09692f50c65d7de652bc4618b97def48a97755c7afe144126aa0a9c0096b9e3e8b808a6276bcc6bd59d7f02
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLYJYH5:1dWubF3n9S91BF3fbokJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4248-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

4248 rundll32.exe

pid	process
4248	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4948 wrote to memory of 4248	4948	rundll32.exe	rundll32.exe
PID 4948 wrote to memory of 4248	4948	rundll32.exe	rundll32.exe
PID 4948 wrote to memory of 4248	4948	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d607b25b2a365015cafa1ac0bd314fc61762732b9947ac4463348df8c36e3e4c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4948

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d607b25b2a365015cafa1ac0bd314fc61762732b9947ac4463348df8c36e3e4c.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:524

memory/4248-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download