gh0strat | 1be500502508116c28c3226f2ede15fc6657baf60474041b06f3a322beb457cb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 20:10

Target

1be500502508116c28c3226f2ede15fc6657baf60474041b06f3a322beb457cb.dll
Size

899KB
MD5

fb478d5b8d725bc5ceb8651377292516
SHA1

c521cfaef688499922f9d28b9727a9a14e8f9736
SHA256

1be500502508116c28c3226f2ede15fc6657baf60474041b06f3a322beb457cb
SHA512

4e6965b6c2ce47739e2dcf4b140b10a2fab69d5de901e91e93d7c5e5e62b0c48cc1e11001fbcdfcd94effe7c56cf48931bb5a109d5c8dc5ed3228252405d2214
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX+:7wqd87V+

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1976-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1976 rundll32.exe

pid	process
1976	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4332 wrote to memory of 1976	4332	rundll32.exe	rundll32.exe
PID 4332 wrote to memory of 1976	4332	rundll32.exe	rundll32.exe
PID 4332 wrote to memory of 1976	4332	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1be500502508116c28c3226f2ede15fc6657baf60474041b06f3a322beb457cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1be500502508116c28c3226f2ede15fc6657baf60474041b06f3a322beb457cb.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1976

memory/1976-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download