gh0strat | 9ac324196d115d9484c64a6ec939e954b016d9c9f5a1f0ccf9e3a0698802ff12

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 06:48

Target

9ac324196d115d9484c64a6ec939e954b016d9c9f5a1f0ccf9e3a0698802ff12.dll
Size

170KB
MD5

ea843113c250841274116df7cedb729c
SHA1

fe5cae56b15a07cba611bc17009857a80c897143
SHA256

9ac324196d115d9484c64a6ec939e954b016d9c9f5a1f0ccf9e3a0698802ff12
SHA512

43fb94a522c0026054f8b8645f69083e01749bbeac2833df27f6e6c39524ff15a270cdf1ee9d820715c03c4707b32271fecafb039e5f8c1c96e2e4c2d8b890f9
SSDEEP

3072:MhPm77B1ZDwB76mVlZPFEqrtI/j4PMG5vY:oWd1ZDg7HhEqrGjm5vY

Score

10^/10

gh0strat rat

Gh0st RAT payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5060-0-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral2/memory/5060-2-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral2/memory/5060-4-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral2/memory/5060-3-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat
behavioral2/memory/5060-8-0x0000000000400000-0x000000000040B000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious use of SetThreadContext 2 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 920 set thread context of 5060	920	rundll32.exe	svchost.exe
PID 920 set thread context of 1612	920	rundll32.exe	svchost.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4500 wrote to memory of 920	4500	rundll32.exe	rundll32.exe
PID 4500 wrote to memory of 920	4500	rundll32.exe	rundll32.exe
PID 4500 wrote to memory of 920	4500	rundll32.exe	rundll32.exe
PID 920 wrote to memory of 5060	920	rundll32.exe	svchost.exe
PID 920 wrote to memory of 5060	920	rundll32.exe	svchost.exe
PID 920 wrote to memory of 5060	920	rundll32.exe	svchost.exe
PID 920 wrote to memory of 5060	920	rundll32.exe	svchost.exe
PID 920 wrote to memory of 5060	920	rundll32.exe	svchost.exe
PID 920 wrote to memory of 5060	920	rundll32.exe	svchost.exe
PID 920 wrote to memory of 5060	920	rundll32.exe	svchost.exe
PID 920 wrote to memory of 5060	920	rundll32.exe	svchost.exe
PID 920 wrote to memory of 1612	920	rundll32.exe	svchost.exe
PID 920 wrote to memory of 1612	920	rundll32.exe	svchost.exe
PID 920 wrote to memory of 1612	920	rundll32.exe	svchost.exe
PID 920 wrote to memory of 1612	920	rundll32.exe	svchost.exe
PID 920 wrote to memory of 1612	920	rundll32.exe	svchost.exe
PID 920 wrote to memory of 1612	920	rundll32.exe	svchost.exe
PID 920 wrote to memory of 1612	920	rundll32.exe	svchost.exe
PID 920 wrote to memory of 1612	920	rundll32.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ac324196d115d9484c64a6ec939e954b016d9c9f5a1f0ccf9e3a0698802ff12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4500

memory/5060-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5060-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5060-4-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5060-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5060-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download