gh0strat | 9fa3cdff6e860173e7d746dc8bde476fdb6a850d864e0bfeb6311aca55e8e6a9

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 12:02

Target

9fa3cdff6e860173e7d746dc8bde476fdb6a850d864e0bfeb6311aca55e8e6a9.dll
Size

899KB
MD5

ac5377df9b718b11e75f67bbc34bf48c
SHA1

2fc2a260e40f9ee1a237bea1c0a4825d6e0ea77b
SHA256

9fa3cdff6e860173e7d746dc8bde476fdb6a850d864e0bfeb6311aca55e8e6a9
SHA512

0dcc6aaa2524394725494fe346192f925980b8788b02bb12a35483875ecb1b88755e8f55020c13e31f37ca9c36335a528598b4d0c1f0e4f331503ae12e816d6d
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX/:7wqd87V/

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2744-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2744 rundll32.exe

pid	process
2744	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2016 wrote to memory of 2744	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 2744	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 2744	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 2744	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 2744	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 2744	2016	rundll32.exe	rundll32.exe
PID 2016 wrote to memory of 2744	2016	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fa3cdff6e860173e7d746dc8bde476fdb6a850d864e0bfeb6311aca55e8e6a9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9fa3cdff6e860173e7d746dc8bde476fdb6a850d864e0bfeb6311aca55e8e6a9.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2744

memory/2744-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download