gh0strat | ca505468106b663042874d6ea339e06489ada784f3f51792d9a5119e8ce73925

Analysis

max time kernel
140s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 06:05

Target

ca505468106b663042874d6ea339e06489ada784f3f51792d9a5119e8ce73925.exe
Size

404KB
MD5

e5b64b28b136c736b6ce2a3d15c40858
SHA1

d7846e2715f2915eecd1905581e11d3ba2b55c41
SHA256

ca505468106b663042874d6ea339e06489ada784f3f51792d9a5119e8ce73925
SHA512

40e7b2936430847189c4d20497ca2f0f64ec184619290bc56abafa437d9d253a2c4d247c2e46ce2183dffb220cfece9f6784a2f80e77241f839a6a535f14fc1f
SSDEEP

6144:5yyLEbWaR5Cc1KKwPo+B1IcWn29BpwNZHZLpyyJhhhhhhhhhhhhhhhZbQJ:kUaWaR5vGsco2tw1LfRi

Score

10^/10

gh0strat rat

Family

gh0strat

U22.zgwl.eu.org

Gh0st RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1612-0-0x0000000010000000-0x0000000010015000-memory.dmp	family_gh0strat
behavioral1/memory/1612-15-0x0000000000400000-0x0000000000467000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Executes dropped EXE 2 IoCs

Processes:

.exe .exe

pid process

2508 .exe
2532 .exe

pid	process
2508	.exe
2532	.exe

Drops file in Program Files directory 2 IoCs

Processes:

ca505468106b663042874d6ea339e06489ada784f3f51792d9a5119e8ce73925.exe

description	ioc	process
File created	C:\Program Files (x86)\ .exe	ca505468106b663042874d6ea339e06489ada784f3f51792d9a5119e8ce73925.exe
File opened for modification	C:\Program Files (x86)\ .exe	ca505468106b663042874d6ea339e06489ada784f3f51792d9a5119e8ce73925.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

ca505468106b663042874d6ea339e06489ada784f3f51792d9a5119e8ce73925.exe .exe .exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

ca505468106b663042874d6ea339e06489ada784f3f51792d9a5119e8ce73925.exe

pid process

1612 ca505468106b663042874d6ea339e06489ada784f3f51792d9a5119e8ce73925.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

.exe

description	pid	process	target process
PID 2508 wrote to memory of 2532	2508	.exe	.exe
PID 2508 wrote to memory of 2532	2508	.exe	.exe
PID 2508 wrote to memory of 2532	2508	.exe	.exe
PID 2508 wrote to memory of 2532	2508	.exe	.exe

C:\Program Files (x86)\ .exe

Filesize
404KB

MD5
e5b64b28b136c736b6ce2a3d15c40858

SHA1
d7846e2715f2915eecd1905581e11d3ba2b55c41

SHA256
ca505468106b663042874d6ea339e06489ada784f3f51792d9a5119e8ce73925

SHA512
40e7b2936430847189c4d20497ca2f0f64ec184619290bc56abafa437d9d253a2c4d247c2e46ce2183dffb220cfece9f6784a2f80e77241f839a6a535f14fc1f

Download Submit
memory/1612-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1612-15-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download