gh0strat | 05b6f442b153c5038dc99a6faf971134096f028f96f52beb610bfc5418c0a1a9

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 06:53

Target

05b6f442b153c5038dc99a6faf971134096f028f96f52beb610bfc5418c0a1a9.dll
Size

51KB
MD5

49d7e093f59f00a3467e4bed1d018305
SHA1

7cba4951e823b025a91bccffc715b85bac97b650
SHA256

05b6f442b153c5038dc99a6faf971134096f028f96f52beb610bfc5418c0a1a9
SHA512

402ba783e17c4d5e2fdae2eb51cd560b608b2f7a097b485046b9f3e23d1d97f852d00c2e567f065012d868f377d9e17ddb3ac91b2f910382e1a116b71661496b
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLLJYH5:1dWubF3n9S91BF3fbovJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2128-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2128 rundll32.exe

pid	process
2128	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2412 wrote to memory of 2128	2412	rundll32.exe	rundll32.exe
PID 2412 wrote to memory of 2128	2412	rundll32.exe	rundll32.exe
PID 2412 wrote to memory of 2128	2412	rundll32.exe	rundll32.exe
PID 2412 wrote to memory of 2128	2412	rundll32.exe	rundll32.exe
PID 2412 wrote to memory of 2128	2412	rundll32.exe	rundll32.exe
PID 2412 wrote to memory of 2128	2412	rundll32.exe	rundll32.exe
PID 2412 wrote to memory of 2128	2412	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05b6f442b153c5038dc99a6faf971134096f028f96f52beb610bfc5418c0a1a9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\05b6f442b153c5038dc99a6faf971134096f028f96f52beb610bfc5418c0a1a9.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2128

memory/2128-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download