gh0strat | 9ac324196d115d9484c64a6ec939e954b016d9c9f5a1f0ccf9e3a0698802ff12

Analysis

max time kernel
128s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 06:48

Target

9ac324196d115d9484c64a6ec939e954b016d9c9f5a1f0ccf9e3a0698802ff12.dll
Size

170KB
MD5

ea843113c250841274116df7cedb729c
SHA1

fe5cae56b15a07cba611bc17009857a80c897143
SHA256

9ac324196d115d9484c64a6ec939e954b016d9c9f5a1f0ccf9e3a0698802ff12
SHA512

43fb94a522c0026054f8b8645f69083e01749bbeac2833df27f6e6c39524ff15a270cdf1ee9d820715c03c4707b32271fecafb039e5f8c1c96e2e4c2d8b890f9
SSDEEP

3072:MhPm77B1ZDwB76mVlZPFEqrtI/j4PMG5vY:oWd1ZDg7HhEqrGjm5vY

Score

10^/10

gh0strat rat

Gh0st RAT payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2196-10-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral1/memory/2196-9-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral1/memory/2196-8-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral1/memory/2196-6-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral1/memory/2196-3-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral1/memory/2196-2-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral1/memory/2196-11-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 2412 set thread context of 2196 2412 rundll32.exe svchost.exe

description	pid	process	target process
PID 2412 set thread context of 2196	2412	rundll32.exe	svchost.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2408 wrote to memory of 2412	2408	rundll32.exe	rundll32.exe
PID 2408 wrote to memory of 2412	2408	rundll32.exe	rundll32.exe
PID 2408 wrote to memory of 2412	2408	rundll32.exe	rundll32.exe
PID 2408 wrote to memory of 2412	2408	rundll32.exe	rundll32.exe
PID 2408 wrote to memory of 2412	2408	rundll32.exe	rundll32.exe
PID 2408 wrote to memory of 2412	2408	rundll32.exe	rundll32.exe
PID 2408 wrote to memory of 2412	2408	rundll32.exe	rundll32.exe
PID 2412 wrote to memory of 2196	2412	rundll32.exe	svchost.exe
PID 2412 wrote to memory of 2196	2412	rundll32.exe	svchost.exe
PID 2412 wrote to memory of 2196	2412	rundll32.exe	svchost.exe
PID 2412 wrote to memory of 2196	2412	rundll32.exe	svchost.exe
PID 2412 wrote to memory of 2196	2412	rundll32.exe	svchost.exe
PID 2412 wrote to memory of 2196	2412	rundll32.exe	svchost.exe
PID 2412 wrote to memory of 2196	2412	rundll32.exe	svchost.exe
PID 2412 wrote to memory of 2196	2412	rundll32.exe	svchost.exe
PID 2412 wrote to memory of 2196	2412	rundll32.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ac324196d115d9484c64a6ec939e954b016d9c9f5a1f0ccf9e3a0698802ff12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408

memory/2196-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2196-10-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2196-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2196-9-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2196-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2196-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2196-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2196-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2196-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2196-11-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download