gh0strat | 5c55552013973c4c22edbd7b1bd9609e62d8ba4ba362fc9bba0357443de584e9

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 18:54

Target

5c55552013973c4c22edbd7b1bd9609e62d8ba4ba362fc9bba0357443de584e9.dll
Size

899KB
MD5

d4be12ba21df6a938d976a32e930554b
SHA1

d5faec276e8bd87a068aba437060bbb14a9478e2
SHA256

5c55552013973c4c22edbd7b1bd9609e62d8ba4ba362fc9bba0357443de584e9
SHA512

210f4270e70f620ab8cc7ace1216360ce808d61f594c337bb7268fe05be2ab50c240e3fc4cba93b0fdfcf60c46232eca21fb1d62ba9ecb2c0e53e803eda23e9e
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX7:7wqd87V7

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2924-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2924 rundll32.exe

pid	process
2924	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2868 wrote to memory of 2924	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2924	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2924	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2924	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2924	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2924	2868	rundll32.exe	rundll32.exe
PID 2868 wrote to memory of 2924	2868	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c55552013973c4c22edbd7b1bd9609e62d8ba4ba362fc9bba0357443de584e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c55552013973c4c22edbd7b1bd9609e62d8ba4ba362fc9bba0357443de584e9.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2924

memory/2924-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download