gh0strat | 81768e97b940dce7ff650662be92250f085f6dce64d554c20733deebe94cd331

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 19:54

Target

81768e97b940dce7ff650662be92250f085f6dce64d554c20733deebe94cd331.dll
Size

899KB
MD5

b5723d100b1e8908a08cc0d4408db1c7
SHA1

0f8a40d83b9cd55cf10db71303fe69a248d8b5fd
SHA256

81768e97b940dce7ff650662be92250f085f6dce64d554c20733deebe94cd331
SHA512

09474543e3946a5e7c143a67da5753ae10ccd63f6a79e4dd77ee6a2231747874649abd04367a1a16301f8f2297f1e8c4581bf7f8a29de43178a6fcf4cff7053c
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXa:7wqd87Va

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2012-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2012 rundll32.exe

pid	process
2012	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2044 wrote to memory of 2012	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 2012	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 2012	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 2012	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 2012	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 2012	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 2012	2044	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\81768e97b940dce7ff650662be92250f085f6dce64d554c20733deebe94cd331.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\81768e97b940dce7ff650662be92250f085f6dce64d554c20733deebe94cd331.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2012

memory/2012-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download