gh0strat | 90e001ab5974745f495c408206fbe90824979cb01b9b977c94c14cbc477d1881

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 08:57

Target

90e001ab5974745f495c408206fbe90824979cb01b9b977c94c14cbc477d1881.dll
Size

899KB
MD5

ee4ab241528def32fc22e78ef5daec48
SHA1

d5632f9c468ef7809d0332949b825fb6436d8fa3
SHA256

90e001ab5974745f495c408206fbe90824979cb01b9b977c94c14cbc477d1881
SHA512

bd971ad97cd128314467c202b0b037bec6822b560d9145ca675d6e61271b4674b0359f3c78ed2d8a25d025f0e88cc28f5241211afe6c3e5ac89beeff54b4c2ba
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXx:7wqd87Vx

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2624-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2624 rundll32.exe

pid	process
2624	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1816 wrote to memory of 2624	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 2624	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 2624	1816	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90e001ab5974745f495c408206fbe90824979cb01b9b977c94c14cbc477d1881.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\90e001ab5974745f495c408206fbe90824979cb01b9b977c94c14cbc477d1881.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2624

memory/2624-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download