gh0strat | 59fa4c17530e8eb74d0e3f9d03ae45de4030951062cbd5ced60ea0a6d9bc6f84

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 01:34

Target

59fa4c17530e8eb74d0e3f9d03ae45de4030951062cbd5ced60ea0a6d9bc6f84.dll
Size

899KB
MD5

be8c2823547dabea324a758e76bda1c4
SHA1

92e45c7a2ce54832c5dd358d7a218d7e2667abe3
SHA256

59fa4c17530e8eb74d0e3f9d03ae45de4030951062cbd5ced60ea0a6d9bc6f84
SHA512

21d427f42f607fb7845aaecf3705f840ccadf609e429824bfd79089d98b990d76cb5e3e12221a2284325b5f1b03ba505d7c5a56d60fdfa0b51cffe7a01e3def3
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXm:7wqd87Vm

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2000-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2000 rundll32.exe

pid	process
2000	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1252 wrote to memory of 2000	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2000	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2000	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2000	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2000	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2000	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2000	1252	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59fa4c17530e8eb74d0e3f9d03ae45de4030951062cbd5ced60ea0a6d9bc6f84.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59fa4c17530e8eb74d0e3f9d03ae45de4030951062cbd5ced60ea0a6d9bc6f84.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2000

memory/2000-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download