gh0strat | 31ba728818b2080fdc98c368a96f82bded96852bed8a5e52251d3f094ac7b107

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 19:20

Target

31ba728818b2080fdc98c368a96f82bded96852bed8a5e52251d3f094ac7b107.dll
Size

899KB
MD5

cf5d4732bdbb33e81532a3a9eabf1bc8
SHA1

12aa0b450fab4c7d2375d7efd8650f84c7f5c282
SHA256

31ba728818b2080fdc98c368a96f82bded96852bed8a5e52251d3f094ac7b107
SHA512

221581c7d1d72b34a4c082d8ad04853fd4648c0d87682b02110056aa69b18bfc44c792b7fe09bd191eb9bcbb5fb939d2b84e17f1d747d3f26e8bd0b10dd6983a
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXw:7wqd87Vw

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2092-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2092 rundll32.exe

pid	process
2092	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2992 wrote to memory of 2092	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 2092	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 2092	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 2092	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 2092	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 2092	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 2092	2992	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31ba728818b2080fdc98c368a96f82bded96852bed8a5e52251d3f094ac7b107.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31ba728818b2080fdc98c368a96f82bded96852bed8a5e52251d3f094ac7b107.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2092

memory/2092-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download