gh0strat | 31f23f696a2d0b1428d3f45a273f3621ec92623d25f874a6c622aa23865c7eb8

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 22:09

Target

31f23f696a2d0b1428d3f45a273f3621ec92623d25f874a6c622aa23865c7eb8.dll
Size

899KB
MD5

11acd418996fbaaf11cab63799bcc6a9
SHA1

f610b5fed0aa4f4908939bb72406f6b668f15f0c
SHA256

31f23f696a2d0b1428d3f45a273f3621ec92623d25f874a6c622aa23865c7eb8
SHA512

d0ddfa092bd480a1c32e835f9902ece4d9db2def521b4468bed7b30719eb1ce757248807f32ff991a7ee4a0f592b9d44a58f7d55bd0a5198b56f6c8b1311b62e
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXe:7wqd87Ve

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2172-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2172	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28
PID 1400 wrote to memory of 2172	1400	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31f23f696a2d0b1428d3f45a273f3621ec92623d25f874a6c622aa23865c7eb8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31f23f696a2d0b1428d3f45a273f3621ec92623d25f874a6c622aa23865c7eb8.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2172

memory/2172-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download