gh0strat | 42f3bf525fa3a024540c36f9685ac1b55f526750bf5b83206cb8a6660ab38495

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 07:27

Target

42f3bf525fa3a024540c36f9685ac1b55f526750bf5b83206cb8a6660ab38495.dll
Size

51KB
MD5

e0ae4f8d901e69e532e2e05977ff8bab
SHA1

e5813014c28791be7a31310bbba63aa126e393d4
SHA256

42f3bf525fa3a024540c36f9685ac1b55f526750bf5b83206cb8a6660ab38495
SHA512

42648fd8a674784980396f419128bf37c84b7effb9da6f2593ca90aeb7f16fed4113feec34dcaaac451eaad28b82c5a7b3dce1a5d3a06d0057beec3056575a14
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLuJYH5:1dWubF3n9S91BF3fboaJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1692-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1692 rundll32.exe

pid	process
1692	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2128 wrote to memory of 1692	2128	rundll32.exe	rundll32.exe
PID 2128 wrote to memory of 1692	2128	rundll32.exe	rundll32.exe
PID 2128 wrote to memory of 1692	2128	rundll32.exe	rundll32.exe
PID 2128 wrote to memory of 1692	2128	rundll32.exe	rundll32.exe
PID 2128 wrote to memory of 1692	2128	rundll32.exe	rundll32.exe
PID 2128 wrote to memory of 1692	2128	rundll32.exe	rundll32.exe
PID 2128 wrote to memory of 1692	2128	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42f3bf525fa3a024540c36f9685ac1b55f526750bf5b83206cb8a6660ab38495.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42f3bf525fa3a024540c36f9685ac1b55f526750bf5b83206cb8a6660ab38495.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:1692

memory/1692-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download