gh0strat | 1da241950115faae8c416ea8c2eaad25ba2c121e3428e204f5de6ae5fc7090a8

Analysis

max time kernel
142s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 07:50

Target

1da241950115faae8c416ea8c2eaad25ba2c121e3428e204f5de6ae5fc7090a8.dll
Size

899KB
MD5

c6e94d62875b82aaca074126cf429c9f
SHA1

715cf4eb8ea2a28ea050b77798daad5998117628
SHA256

1da241950115faae8c416ea8c2eaad25ba2c121e3428e204f5de6ae5fc7090a8
SHA512

4a9a6b06c12c813eb9e85ca1f0008d9f56b4fffbde974cad73a123b4597deb6106c0475d5ecde2b7f3d6d02487a388a401e4642bbad90b506bf19e7e0ed90e44
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXR:7wqd87VR

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2656-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2656 rundll32.exe

pid	process
2656	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2724 wrote to memory of 2656	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 2656	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 2656	2724	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1da241950115faae8c416ea8c2eaad25ba2c121e3428e204f5de6ae5fc7090a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1da241950115faae8c416ea8c2eaad25ba2c121e3428e204f5de6ae5fc7090a8.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2656

memory/2656-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download