gh0strat | ea81105cad53fc275fbd09591ad6300867721b9329545adaeb1a00b79863ca50

Analysis

max time kernel
143s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 01:33

Target

ea81105cad53fc275fbd09591ad6300867721b9329545adaeb1a00b79863ca50.dll
Size

163KB
MD5

c89c2af0c0fdf4d878164a13872f1f24
SHA1

c5f81776c76149fb52c4becf16a3c7964882a4e6
SHA256

ea81105cad53fc275fbd09591ad6300867721b9329545adaeb1a00b79863ca50
SHA512

eea5cad1957c1b60205c1befb4e5f2d84419ee2788f118eddd383bcbc32041dcab5256cfcb36a1fe995a75ec0fefde7fe238deb110c0fa4f2d2397679e44e9a8
SSDEEP

3072:LUDBHy4BBy6eFJrmmIewRxM6JSQTqGd4Pwc3q:L0yB6oJrcRZQcqGywq

Score

10^/10

gh0strat rat

Gh0st RAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4644-0-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral2/memory/2440-5-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral2/memory/4644-6-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral2/memory/4644-7-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious use of SetThreadContext 2 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1616 set thread context of 4644	1616	rundll32.exe	svchost.exe
PID 1616 set thread context of 2440	1616	rundll32.exe	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1616 wrote to memory of 4644	1616	rundll32.exe	svchost.exe
PID 1616 wrote to memory of 4644	1616	rundll32.exe	svchost.exe
PID 1616 wrote to memory of 4644	1616	rundll32.exe	svchost.exe
PID 1616 wrote to memory of 4644	1616	rundll32.exe	svchost.exe
PID 1616 wrote to memory of 4644	1616	rundll32.exe	svchost.exe
PID 1616 wrote to memory of 4644	1616	rundll32.exe	svchost.exe
PID 1616 wrote to memory of 4644	1616	rundll32.exe	svchost.exe
PID 1616 wrote to memory of 4644	1616	rundll32.exe	svchost.exe
PID 1616 wrote to memory of 2440	1616	rundll32.exe	svchost.exe
PID 1616 wrote to memory of 2440	1616	rundll32.exe	svchost.exe
PID 1616 wrote to memory of 2440	1616	rundll32.exe	svchost.exe
PID 1616 wrote to memory of 2440	1616	rundll32.exe	svchost.exe
PID 1616 wrote to memory of 2440	1616	rundll32.exe	svchost.exe
PID 1616 wrote to memory of 2440	1616	rundll32.exe	svchost.exe
PID 1616 wrote to memory of 2440	1616	rundll32.exe	svchost.exe
PID 1616 wrote to memory of 2440	1616	rundll32.exe	svchost.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:3900

memory/2440-5-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4644-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4644-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4644-7-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download