gh0strat | 031ad133796dac1f4f006be1b9e688e280265306c6a63274b9642635cd4e37dc

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 18:04

Target

031ad133796dac1f4f006be1b9e688e280265306c6a63274b9642635cd4e37dc.dll
Size

899KB
MD5

03a9bb277f6c8280b6fb1228fdfc81de
SHA1

454c9989d7a16c4b43f51743a80a5ac683621e6f
SHA256

031ad133796dac1f4f006be1b9e688e280265306c6a63274b9642635cd4e37dc
SHA512

3dfe1e6f322fbfbc41b8b1c17f2af9920a5737f88336979ea79f0fdb6cf0ec53d89b9a5fdad1eda796b7bf2da1940074a01f2b5ee5c03737c196d0ffcf2c0c13
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXv:7wqd87Vv

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1976-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1976 rundll32.exe

pid	process
1976	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3104 wrote to memory of 1976	3104	rundll32.exe	rundll32.exe
PID 3104 wrote to memory of 1976	3104	rundll32.exe	rundll32.exe
PID 3104 wrote to memory of 1976	3104	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\031ad133796dac1f4f006be1b9e688e280265306c6a63274b9642635cd4e37dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3104

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\031ad133796dac1f4f006be1b9e688e280265306c6a63274b9642635cd4e37dc.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:1976

memory/1976-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download