gh0strat | c202be61f0275d1873ad68ae8a04ad3826cb29bee81a796d204f1f83924c3303

Analysis

max time kernel
149s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 07:39

Target

c202be61f0275d1873ad68ae8a04ad3826cb29bee81a796d204f1f83924c3303.dll
Size

899KB
MD5

413d531be19be2ad06221c84bd810245
SHA1

59a79f8cd0cf1e74e6360531519cd4022d449e7f
SHA256

c202be61f0275d1873ad68ae8a04ad3826cb29bee81a796d204f1f83924c3303
SHA512

d0f6021194f9afc31268a35362e9e39a937bdbeb79b174dbbaa63f89c65a700ac4e8f5b7c4159cedbe93004525f678298c3777e86392c7769c053494545859f5
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXf:7wqd87Vf

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1368-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1368 rundll32.exe

pid	process
1368	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4164 wrote to memory of 1368	4164	rundll32.exe	rundll32.exe
PID 4164 wrote to memory of 1368	4164	rundll32.exe	rundll32.exe
PID 4164 wrote to memory of 1368	4164	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c202be61f0275d1873ad68ae8a04ad3826cb29bee81a796d204f1f83924c3303.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4164

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c202be61f0275d1873ad68ae8a04ad3826cb29bee81a796d204f1f83924c3303.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:1368

memory/1368-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download