gh0strat | a27c1dc2f1d85a20089040d2c4aaa121b61dd04e13ebb8ab79c856a3ed4c14c2

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 06:53

Target

a27c1dc2f1d85a20089040d2c4aaa121b61dd04e13ebb8ab79c856a3ed4c14c2.dll
Size

899KB
MD5

59aa28052da54c63ce9b1d81227611b1
SHA1

d026ee8f53286476cce21c5aedafd1392920b92d
SHA256

a27c1dc2f1d85a20089040d2c4aaa121b61dd04e13ebb8ab79c856a3ed4c14c2
SHA512

aa59de02a4449c887fabe89caf109bfe5e06d0d13cc05b11a5f25db947af43f1f5ff268a562c93608a4b3e7b321c66f618db553a652f233f11c0fb22803d9e74
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX5:7wqd87V5

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4320-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

4320 rundll32.exe

pid	process
4320	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3056 wrote to memory of 4320	3056	rundll32.exe	rundll32.exe
PID 3056 wrote to memory of 4320	3056	rundll32.exe	rundll32.exe
PID 3056 wrote to memory of 4320	3056	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a27c1dc2f1d85a20089040d2c4aaa121b61dd04e13ebb8ab79c856a3ed4c14c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a27c1dc2f1d85a20089040d2c4aaa121b61dd04e13ebb8ab79c856a3ed4c14c2.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:4320

memory/4320-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download