gh0strat | 3d2a4c8c29d0724a45c253dc51b170dbe669d1d35dec68e948a61f2e074d49a2

Analysis

max time kernel
143s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 20:03

Target

3d2a4c8c29d0724a45c253dc51b170dbe669d1d35dec68e948a61f2e074d49a2.dll
Size

51KB
MD5

c3018617a2780c74d511ca11095f7b0b
SHA1

76c14c7f1e7c9c17d38bdedf7acff0bea6353ecf
SHA256

3d2a4c8c29d0724a45c253dc51b170dbe669d1d35dec68e948a61f2e074d49a2
SHA512

ab047bb7aeeb6560f0cf9ca07c674985637f3660532ecea03dcfbda8d705258f97b396390ab05ef0c89fe0ae32e27e586531cdc42d5c4c90dfa9bfac78641a2a
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLgJYH5:1dWubF3n9S91BF3fbocJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2184-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2184 rundll32.exe

pid	process
2184	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2008 wrote to memory of 2184	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 2184	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 2184	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 2184	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 2184	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 2184	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 2184	2008	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d2a4c8c29d0724a45c253dc51b170dbe669d1d35dec68e948a61f2e074d49a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d2a4c8c29d0724a45c253dc51b170dbe669d1d35dec68e948a61f2e074d49a2.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2184

memory/2184-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download