gh0strat | 55b45b0c3fa18f27ec488081019a8faea4385dcfd925c7048001e7672d14ae99

Analysis

max time kernel
140s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 20:00

Target

55b45b0c3fa18f27ec488081019a8faea4385dcfd925c7048001e7672d14ae99.dll
Size

899KB
MD5

8fcaec2c8ab54979aed66c4251a164e3
SHA1

f7761b5ce061b85bc0d39fc610e528aea9bbd935
SHA256

55b45b0c3fa18f27ec488081019a8faea4385dcfd925c7048001e7672d14ae99
SHA512

f7a8cd808817e839308aa9e6057b382228bf3d854d0138bb3cc8a53264180dad0ad363678717d1816243c29225477e0f77e2ea216c0f71a77f49ce90eb7b28aa
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXp:7wqd87Vp

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2108-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2108 rundll32.exe

pid	process
2108	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3364 wrote to memory of 2108	3364	rundll32.exe	rundll32.exe
PID 3364 wrote to memory of 2108	3364	rundll32.exe	rundll32.exe
PID 3364 wrote to memory of 2108	3364	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55b45b0c3fa18f27ec488081019a8faea4385dcfd925c7048001e7672d14ae99.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55b45b0c3fa18f27ec488081019a8faea4385dcfd925c7048001e7672d14ae99.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2108

memory/2108-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download