gh0strat | 67c42f2319cd41687386b246c450f548349e85c00c36b41eef37aa5f98e3efbe

Analysis

max time kernel
141s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 03:34

Target

67c42f2319cd41687386b246c450f548349e85c00c36b41eef37aa5f98e3efbe.dll
Size

899KB
MD5

feecc4ed5ba33cb4a6d7a57a79e45d11
SHA1

c005f0dd140c37d17cbce6320b84c69a48cea7a7
SHA256

67c42f2319cd41687386b246c450f548349e85c00c36b41eef37aa5f98e3efbe
SHA512

bf5b076ddc2827a86892ac8394c7850145b3d1ba143a09e4bda61e236b8da779c2bbe9c692237325c79b72aa11fd2302dd0636604b38b7eac617173889fb4c78
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXp:7wqd87Vp

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1684-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1684 rundll32.exe

pid	process
1684	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2824 wrote to memory of 1684	2824	rundll32.exe	rundll32.exe
PID 2824 wrote to memory of 1684	2824	rundll32.exe	rundll32.exe
PID 2824 wrote to memory of 1684	2824	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67c42f2319cd41687386b246c450f548349e85c00c36b41eef37aa5f98e3efbe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67c42f2319cd41687386b246c450f548349e85c00c36b41eef37aa5f98e3efbe.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:1684

memory/1684-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download