gh0strat | eb085517193ed5bac61f8d15872bb4213e5a88d3730d7765d1e4d740e1951461

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 03:49

Target

eb085517193ed5bac61f8d15872bb4213e5a88d3730d7765d1e4d740e1951461.dll
Size

899KB
MD5

50befda8f7611c697dfbc9168a92fcf5
SHA1

426adac107ba7cb5980fb77d3bdbf596e1daaa3f
SHA256

eb085517193ed5bac61f8d15872bb4213e5a88d3730d7765d1e4d740e1951461
SHA512

bed61af5fc28b52f5f73853839db4442f49af1ebe03783b53a748e1bc0df71402d76319c68fb99299d3945d5128a7c2a49a30351eeec3d2afd78be3954862392
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXE:7wqd87VE

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/348-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

348 rundll32.exe

pid	process
348	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1796 wrote to memory of 348	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 348	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 348	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 348	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 348	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 348	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 348	1796	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb085517193ed5bac61f8d15872bb4213e5a88d3730d7765d1e4d740e1951461.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eb085517193ed5bac61f8d15872bb4213e5a88d3730d7765d1e4d740e1951461.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:348

memory/348-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download