gh0strat | f2e339b62797eb0f3e9efbb8955b73c7a3cec296b3b423a85dd1df9d49f295ec

Analysis

max time kernel
148s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 10:25

Target

f2e339b62797eb0f3e9efbb8955b73c7a3cec296b3b423a85dd1df9d49f295ec.dll
Size

50KB
MD5

b98c5bbb2c825934271319f5c1258e1c
SHA1

9211598f76c19007b1c34b1695d587de8a34646d
SHA256

f2e339b62797eb0f3e9efbb8955b73c7a3cec296b3b423a85dd1df9d49f295ec
SHA512

7af5109daf41836afc4ea77ea2693244f556ea1f123bf4487d9241e1cb2b4e4e95f637d8588749f847594c65cc6878aa930d49ddc92218037456cecd2c4002b9
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5dJYH:W5ReWjTrW9rNPgYoDJYH

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1748-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1748 rundll32.exe

pid	process
1748	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3432 wrote to memory of 1748	3432	rundll32.exe	rundll32.exe
PID 3432 wrote to memory of 1748	3432	rundll32.exe	rundll32.exe
PID 3432 wrote to memory of 1748	3432	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2e339b62797eb0f3e9efbb8955b73c7a3cec296b3b423a85dd1df9d49f295ec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3432

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2e339b62797eb0f3e9efbb8955b73c7a3cec296b3b423a85dd1df9d49f295ec.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:1748

memory/1748-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download