gh0strat | 3a86ddee55b28ce7608ffcc8b9700ece5670428383d192b31acfb44584d2d698

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 20:33

Target

3a86ddee55b28ce7608ffcc8b9700ece5670428383d192b31acfb44584d2d698.dll
Size

899KB
MD5

e20c3ea55da82e224bc06edb27217501
SHA1

cf0f36cc15685db216e18953cec48f4152e8411c
SHA256

3a86ddee55b28ce7608ffcc8b9700ece5670428383d192b31acfb44584d2d698
SHA512

cb321aa9b17d39129e2ad47502ddcb5c9fff4bcbd8af6520ea12d35382d39c317d1b102898481e63284fc9aa0849d5de24df98493568b88826876e9f5423cd78
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXe:7wqd87Ve

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1276-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1276 rundll32.exe

pid	process
1276	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2796 wrote to memory of 1276	2796	rundll32.exe	rundll32.exe
PID 2796 wrote to memory of 1276	2796	rundll32.exe	rundll32.exe
PID 2796 wrote to memory of 1276	2796	rundll32.exe	rundll32.exe
PID 2796 wrote to memory of 1276	2796	rundll32.exe	rundll32.exe
PID 2796 wrote to memory of 1276	2796	rundll32.exe	rundll32.exe
PID 2796 wrote to memory of 1276	2796	rundll32.exe	rundll32.exe
PID 2796 wrote to memory of 1276	2796	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a86ddee55b28ce7608ffcc8b9700ece5670428383d192b31acfb44584d2d698.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a86ddee55b28ce7608ffcc8b9700ece5670428383d192b31acfb44584d2d698.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:1276

memory/1276-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download