gh0strat | 090a4c2e9fd2586ee2507447477db6be041e15156bc00de2cf76e70261f2180a

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 20:44

Target

090a4c2e9fd2586ee2507447477db6be041e15156bc00de2cf76e70261f2180a.dll
Size

51KB
MD5

9423fe6ecd78da68d27567754f61a784
SHA1

82ce08c3327fbac21f617ca865e1a74335d5db1f
SHA256

090a4c2e9fd2586ee2507447477db6be041e15156bc00de2cf76e70261f2180a
SHA512

819b64c40f11f6a5d5d1b5b2344a5e52475f65bdb19a63677cec5fcba3dae61a48996a5ecdf33a4e00fc30abbf423285d117d577c6df5c842beea853c22d1f84
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLgJYH5:1dWubF3n9S91BF3fbo8JYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2228-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2228 rundll32.exe

pid	process
2228	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2200 wrote to memory of 2228	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2228	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2228	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2228	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2228	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2228	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2228	2200	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\090a4c2e9fd2586ee2507447477db6be041e15156bc00de2cf76e70261f2180a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\090a4c2e9fd2586ee2507447477db6be041e15156bc00de2cf76e70261f2180a.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2228

memory/2228-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download