gh0strat | ea81105cad53fc275fbd09591ad6300867721b9329545adaeb1a00b79863ca50

Analysis

max time kernel
128s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 01:33

Target

ea81105cad53fc275fbd09591ad6300867721b9329545adaeb1a00b79863ca50.dll
Size

163KB
MD5

c89c2af0c0fdf4d878164a13872f1f24
SHA1

c5f81776c76149fb52c4becf16a3c7964882a4e6
SHA256

ea81105cad53fc275fbd09591ad6300867721b9329545adaeb1a00b79863ca50
SHA512

eea5cad1957c1b60205c1befb4e5f2d84419ee2788f118eddd383bcbc32041dcab5256cfcb36a1fe995a75ec0fefde7fe238deb110c0fa4f2d2397679e44e9a8
SSDEEP

3072:LUDBHy4BBy6eFJrmmIewRxM6JSQTqGd4Pwc3q:L0yB6oJrcRZQcqGywq

Score

10^/10

gh0strat rat

Gh0st RAT payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1924-8-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral1/memory/1924-9-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral1/memory/1924-7-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral1/memory/1924-5-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral1/memory/1924-3-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral1/memory/1924-2-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral1/memory/1924-10-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 2088 set thread context of 1924 2088 rundll32.exe svchost.exe

description	pid	process	target process
PID 2088 set thread context of 1924	2088	rundll32.exe	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2088 wrote to memory of 1924	2088	rundll32.exe	svchost.exe
PID 2088 wrote to memory of 1924	2088	rundll32.exe	svchost.exe
PID 2088 wrote to memory of 1924	2088	rundll32.exe	svchost.exe
PID 2088 wrote to memory of 1924	2088	rundll32.exe	svchost.exe
PID 2088 wrote to memory of 1924	2088	rundll32.exe	svchost.exe
PID 2088 wrote to memory of 1924	2088	rundll32.exe	svchost.exe
PID 2088 wrote to memory of 1924	2088	rundll32.exe	svchost.exe
PID 2088 wrote to memory of 1924	2088	rundll32.exe	svchost.exe
PID 2088 wrote to memory of 1924	2088	rundll32.exe	svchost.exe

memory/1924-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1924-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1924-9-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1924-7-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1924-5-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1924-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1924-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1924-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1924-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1924-10-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download