gh0strat | cb17aa3019cf3f9e3532cf8c1acb33a42cdd61ac37c0da54c49a48f8b68a05be

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 02:59

Target

cb17aa3019cf3f9e3532cf8c1acb33a42cdd61ac37c0da54c49a48f8b68a05be.dll
Size

899KB
MD5

1ad0fb3b82f45cd954a77e1045b4d550
SHA1

6c8d40f62846bd7d8f92c9059653c8607b50f5b2
SHA256

cb17aa3019cf3f9e3532cf8c1acb33a42cdd61ac37c0da54c49a48f8b68a05be
SHA512

4b4a9af7351e18ad858c4447015e9cf725854d5820d5cb0f18011111af0ed899f735c4dc22cdec8b6f1506d86bef64d2166ba2ae4ff29981f32ea0f80444d171
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXJ:7wqd87VJ

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1776-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1776 rundll32.exe

pid	process
1776	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2740 wrote to memory of 1776	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 1776	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 1776	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 1776	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 1776	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 1776	2740	rundll32.exe	rundll32.exe
PID 2740 wrote to memory of 1776	2740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb17aa3019cf3f9e3532cf8c1acb33a42cdd61ac37c0da54c49a48f8b68a05be.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb17aa3019cf3f9e3532cf8c1acb33a42cdd61ac37c0da54c49a48f8b68a05be.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:1776

memory/1776-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download