gh0strat | 747295b4bff0a978290c20a64afd6449732fb20284802cc1d0a50095620ed86b

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 03:51

Target

747295b4bff0a978290c20a64afd6449732fb20284802cc1d0a50095620ed86b.dll
Size

50KB
MD5

8ca6d969fa4530cf5019f83b05de8781
SHA1

1e202eddb86ae467d06e62b3e2dd293ff8e25267
SHA256

747295b4bff0a978290c20a64afd6449732fb20284802cc1d0a50095620ed86b
SHA512

4846e063dbdd6d28679c0de560f0da1c2846f27411e3ebafec40b7884b4982519d9a7881ed494b0a09ed3ea65d060b69f5704966e084c9f2842015df5c8fb332
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5vJYH:W5ReWjTrW9rNPgYoNJYH

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1988-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1988 rundll32.exe

pid	process
1988	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2236 wrote to memory of 1988	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 1988	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 1988	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 1988	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 1988	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 1988	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 1988	2236	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\747295b4bff0a978290c20a64afd6449732fb20284802cc1d0a50095620ed86b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\747295b4bff0a978290c20a64afd6449732fb20284802cc1d0a50095620ed86b.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1988

memory/1988-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download