gh0strat | 86f04264176b95d9ce687e21c936d6c8bac184a53f9d465329b7f794f56ba2ff

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 04:47

Target

86f04264176b95d9ce687e21c936d6c8bac184a53f9d465329b7f794f56ba2ff.dll
Size

899KB
MD5

47e19f50e8daa93633bcf148d6e0f618
SHA1

16f19ce9daaa5e7c14f04a56adca5d867730db2c
SHA256

86f04264176b95d9ce687e21c936d6c8bac184a53f9d465329b7f794f56ba2ff
SHA512

8049092f575a6a8f7ccc573a900510adc6f6ed36964cc86ddbd1e78f5263184e78a28ef006e45e310709b8c71572af2fb15cd3f9b99eaf4a50276d148f4c6a78
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXp:7wqd87Vp

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2188-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2188 rundll32.exe

pid	process
2188	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2200 wrote to memory of 2188	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2188	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2188	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2188	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2188	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2188	2200	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2188	2200	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86f04264176b95d9ce687e21c936d6c8bac184a53f9d465329b7f794f56ba2ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86f04264176b95d9ce687e21c936d6c8bac184a53f9d465329b7f794f56ba2ff.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2188

memory/2188-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download