gh0strat | aada59a86a81e26957579b326d51eae8689093f3cc5a6b6acf813f0b744314ad

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 19:36

Target

aada59a86a81e26957579b326d51eae8689093f3cc5a6b6acf813f0b744314ad.dll
Size

899KB
MD5

e6eedcf54635a11a6560a9424a4eca64
SHA1

8649c5127fca098ce7db638847467c6409394777
SHA256

aada59a86a81e26957579b326d51eae8689093f3cc5a6b6acf813f0b744314ad
SHA512

ad068c6c184c6f6ac47a5ec3a72b11a99823eca9020ddea7506d388fbb9f4ac9a58938539c51506d1c9c7846901a2b1a5ff84cdffa44230586d34e60d086aeea
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXm:7wqd87Vm

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2544-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2544 rundll32.exe

pid	process
2544	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aada59a86a81e26957579b326d51eae8689093f3cc5a6b6acf813f0b744314ad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aada59a86a81e26957579b326d51eae8689093f3cc5a6b6acf813f0b744314ad.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2544

memory/2544-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download