gh0strat | 8879072d0cea121395c60e04b9c640b69b091115f535bf12bcfc256e99a09225

Analysis

max time kernel
140s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 03:43

Target

8879072d0cea121395c60e04b9c640b69b091115f535bf12bcfc256e99a09225.dll
Size

50KB
MD5

b50c8a6bb0f03ebc448b37a665cc0463
SHA1

c511fddcd2309934bc8f89ade47e9d36cf3e9464
SHA256

8879072d0cea121395c60e04b9c640b69b091115f535bf12bcfc256e99a09225
SHA512

8cf10c950e9818727f3d34fc0130f81378d18fda991149da995367cc764fcd43c1f29b11d7567178308c9d6931e41271317c18d1c783ec1fe424c336bd69767b
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5+JYH:W5ReWjTrW9rNPgYogJYH

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/864-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

864 rundll32.exe

pid	process
864	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3112 wrote to memory of 864	3112	rundll32.exe	rundll32.exe
PID 3112 wrote to memory of 864	3112	rundll32.exe	rundll32.exe
PID 3112 wrote to memory of 864	3112	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8879072d0cea121395c60e04b9c640b69b091115f535bf12bcfc256e99a09225.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3112

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8879072d0cea121395c60e04b9c640b69b091115f535bf12bcfc256e99a09225.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4156,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:8
1⤵
PID:2888

memory/864-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download