gh0strat | 86f04264176b95d9ce687e21c936d6c8bac184a53f9d465329b7f794f56ba2ff

Analysis

max time kernel
141s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 04:47

Target

86f04264176b95d9ce687e21c936d6c8bac184a53f9d465329b7f794f56ba2ff.dll
Size

899KB
MD5

47e19f50e8daa93633bcf148d6e0f618
SHA1

16f19ce9daaa5e7c14f04a56adca5d867730db2c
SHA256

86f04264176b95d9ce687e21c936d6c8bac184a53f9d465329b7f794f56ba2ff
SHA512

8049092f575a6a8f7ccc573a900510adc6f6ed36964cc86ddbd1e78f5263184e78a28ef006e45e310709b8c71572af2fb15cd3f9b99eaf4a50276d148f4c6a78
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXp:7wqd87Vp

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1956-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1956 rundll32.exe

pid	process
1956	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4480 wrote to memory of 1956	4480	rundll32.exe	rundll32.exe
PID 4480 wrote to memory of 1956	4480	rundll32.exe	rundll32.exe
PID 4480 wrote to memory of 1956	4480	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86f04264176b95d9ce687e21c936d6c8bac184a53f9d465329b7f794f56ba2ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4480

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86f04264176b95d9ce687e21c936d6c8bac184a53f9d465329b7f794f56ba2ff.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3772 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:2044

memory/1956-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download