gh0strat | 2da007aba4ab5020d3bbfc77ee7b27131ac91329132d50c65540ce61ea69212f

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 18:51

Target

2da007aba4ab5020d3bbfc77ee7b27131ac91329132d50c65540ce61ea69212f.dll
Size

899KB
MD5

03a0eb1a0bfc1c6946179418ce1c266e
SHA1

e0e7b888933fb976920b700bf86db59f5e481774
SHA256

2da007aba4ab5020d3bbfc77ee7b27131ac91329132d50c65540ce61ea69212f
SHA512

22d3c2c0b0235bc528547ef3c13c719935344ed0e645eabb4c81f3e41924c5314a17b0519018f16957dccbd760f53beeebc3ff24a08791e3067739f8a6ea01be
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXt:7wqd87Vt

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1360-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1360 rundll32.exe

pid	process
1360	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2024 wrote to memory of 1360	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 1360	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 1360	2024	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2da007aba4ab5020d3bbfc77ee7b27131ac91329132d50c65540ce61ea69212f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2da007aba4ab5020d3bbfc77ee7b27131ac91329132d50c65540ce61ea69212f.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:1360

memory/1360-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download