gh0strat | 2bfcbd28cbf00c4f6bc3f9431f9bf5e1248d1e784b12f95f41dfbf59b2e4e6a4

Analysis

max time kernel
145s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 17:52

Target
2bfcbd28cbf00c4f6bc3f9431f9bf5e1248d1e784b12f95f41dfbf59b2e4e6a4.dll
Size 51KB
Sample240526-wfx47afd55
SHA256 2bfcbd28cbf00c4f6bc3f9431f9bf5e1248d1e784b12f95f41dfbf59b2e4e6a4
MD5 f4a99f1ea53f8ef14d58495792c28768
SHA1 9e41ed5da121db1c58059de7d7cc7caa9f638f0c
SHA512 b755f56df4f6db346be544616f056550cce5da4f17aeb60b9883ae2b72abdcace3a2f755cab03f761cb0df48010f9efac7fade9553124545b2082bc68ac5c404
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL0JYH5:1dWubF3n9S91BF3fbowJYH5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4140-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4140	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4140	1124	rundll32.exe	83
PID 1124 wrote to memory of 4140	1124	rundll32.exe	83
PID 1124 wrote to memory of 4140	1124	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bfcbd28cbf00c4f6bc3f9431f9bf5e1248d1e784b12f95f41dfbf59b2e4e6a4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bfcbd28cbf00c4f6bc3f9431f9bf5e1248d1e784b12f95f41dfbf59b2e4e6a4.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4140

memory/4140-0-0x0000000010000000-0x0000000010011000-memory.dmp

Download