gh0strat | 61a17886fc167fe0ad0288b0fed3d292d8b157d6466a1a73fe3ac9ca251ba4fc

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 19:51

Target

61a17886fc167fe0ad0288b0fed3d292d8b157d6466a1a73fe3ac9ca251ba4fc.dll
Size

51KB
MD5

b6fd1599549c1bb81996f497c87c5c8d
SHA1

b3a8c4e47fa43f23cc924f4a8bb02ac69cf46310
SHA256

61a17886fc167fe0ad0288b0fed3d292d8b157d6466a1a73fe3ac9ca251ba4fc
SHA512

91ea67d4a1edf57a819ac8c59387563940ea444ac368bfa798340d3227dc9f3cb78963387723face3eaad682fb9f13e2778a9fea46cf6e5e89ed414347bd484a
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL0JYH5:1dWubF3n9S91BF3fboQJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2996-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2996 rundll32.exe

pid	process
2996	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4728 wrote to memory of 2996	4728	rundll32.exe	rundll32.exe
PID 4728 wrote to memory of 2996	4728	rundll32.exe	rundll32.exe
PID 4728 wrote to memory of 2996	4728	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61a17886fc167fe0ad0288b0fed3d292d8b157d6466a1a73fe3ac9ca251ba4fc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61a17886fc167fe0ad0288b0fed3d292d8b157d6466a1a73fe3ac9ca251ba4fc.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2996

memory/2996-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download