gh0strat | b450c07246ae31417b0b1282b3763d7c5f45805905e741a3705f4f06b16c3b83

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 18:48

Target

b450c07246ae31417b0b1282b3763d7c5f45805905e741a3705f4f06b16c3b83.dll
Size

899KB
MD5

f8898cc20f3d1401feb3c6e64286578d
SHA1

09b3bdcaa5700b4f858f80492b3c58d5b3c61f17
SHA256

b450c07246ae31417b0b1282b3763d7c5f45805905e741a3705f4f06b16c3b83
SHA512

d6d29cbfa80064717092e9952a38ead6d02fa831a622451a31ded2f6a82847bb65bd8579633c80e806aec382556aa77061170f886ad2797bcffe0721f4258986
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXL:7wqd87VL

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2320-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2320 rundll32.exe

pid	process
2320	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2696 wrote to memory of 2320	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2320	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2320	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2320	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2320	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2320	2696	rundll32.exe	rundll32.exe
PID 2696 wrote to memory of 2320	2696	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b450c07246ae31417b0b1282b3763d7c5f45805905e741a3705f4f06b16c3b83.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2696

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b450c07246ae31417b0b1282b3763d7c5f45805905e741a3705f4f06b16c3b83.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2320

memory/2320-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download