gh0strat | a1a21e25b682078411e2997af4d9f34fd55f436222aab6741504db1f8a03fbd0

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 10:43

Target

a1a21e25b682078411e2997af4d9f34fd55f436222aab6741504db1f8a03fbd0.dll
Size

899KB
MD5

b4a0f6b08d318b9668909f610b60d07d
SHA1

1c2113f8c54f1ad91a54a425370b110a218c99ba
SHA256

a1a21e25b682078411e2997af4d9f34fd55f436222aab6741504db1f8a03fbd0
SHA512

feb8ad3cfc688e74280b8bcf65156c73598a892766205079040b1b2722328f0d98a481cb56afe230b6c0af9a5de28e9e3aedd1c3a9886b309a5d768457a64273
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXd:7wqd87Vd

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2432-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2432 rundll32.exe

pid	process
2432	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2924 wrote to memory of 2432	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2432	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2432	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2432	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2432	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2432	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2432	2924	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1a21e25b682078411e2997af4d9f34fd55f436222aab6741504db1f8a03fbd0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1a21e25b682078411e2997af4d9f34fd55f436222aab6741504db1f8a03fbd0.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2432

memory/2432-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download