gh0strat | 46f5a9fbbf8e75f20f99d3b92dc1d620fcc0259953d086da7fce2b566f072934

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 12:13

Target

46f5a9fbbf8e75f20f99d3b92dc1d620fcc0259953d086da7fce2b566f072934.dll
Size

51KB
MD5

7f4ee4be4c1fcfa930baf9ede5cd68b4
SHA1

a134f8ca152fef7b581d94085b8f0777df24478e
SHA256

46f5a9fbbf8e75f20f99d3b92dc1d620fcc0259953d086da7fce2b566f072934
SHA512

81335b6cdf2d660c4604bc6a419f41387cb16a79626dccb04cd2190babe7b5e2658d2ad5c9490ada477124fe6786cd46a2f6cff2c1988c04ef429be8a6d8c728
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLOJYH5:1dWubF3n9S91BF3fboCJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1464-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

1464 rundll32.exe

pid	process
1464	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3008 wrote to memory of 1464	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 1464	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 1464	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 1464	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 1464	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 1464	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 1464	3008	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46f5a9fbbf8e75f20f99d3b92dc1d620fcc0259953d086da7fce2b566f072934.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\46f5a9fbbf8e75f20f99d3b92dc1d620fcc0259953d086da7fce2b566f072934.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:1464

memory/1464-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download