gh0strat | c202be61f0275d1873ad68ae8a04ad3826cb29bee81a796d204f1f83924c3303

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 07:39

Target

c202be61f0275d1873ad68ae8a04ad3826cb29bee81a796d204f1f83924c3303.dll
Size

899KB
MD5

413d531be19be2ad06221c84bd810245
SHA1

59a79f8cd0cf1e74e6360531519cd4022d449e7f
SHA256

c202be61f0275d1873ad68ae8a04ad3826cb29bee81a796d204f1f83924c3303
SHA512

d0f6021194f9afc31268a35362e9e39a937bdbeb79b174dbbaa63f89c65a700ac4e8f5b7c4159cedbe93004525f678298c3777e86392c7769c053494545859f5
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXf:7wqd87Vf

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2988-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2988 rundll32.exe

pid	process
2988	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2424 wrote to memory of 2988	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2988	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2988	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2988	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2988	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2988	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2988	2424	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c202be61f0275d1873ad68ae8a04ad3826cb29bee81a796d204f1f83924c3303.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c202be61f0275d1873ad68ae8a04ad3826cb29bee81a796d204f1f83924c3303.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2988

memory/2988-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download