gh0strat | 204df8d00dcf85419965f7313595d3cc95a0363f98fa05433fb3d4e6d963265c

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 03:58

Target

204df8d00dcf85419965f7313595d3cc95a0363f98fa05433fb3d4e6d963265c.dll
Size

899KB
MD5

de66e8084b87e51c28f981a69045ef62
SHA1

ca54c2f951004ffb93ae9a69e32596edfd34fa73
SHA256

204df8d00dcf85419965f7313595d3cc95a0363f98fa05433fb3d4e6d963265c
SHA512

ea591c5523ff41321d2233d3fa0ada4b352c210bc35a5e9bc8c17f4a1531488cd130582afa36c2e6d9beb959d01a42dc0c6d6d809ef42daf01ceff6ca196a81d
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXI:7wqd87VI

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1728-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1728	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1728	2032	rundll32.exe	28
PID 2032 wrote to memory of 1728	2032	rundll32.exe	28
PID 2032 wrote to memory of 1728	2032	rundll32.exe	28
PID 2032 wrote to memory of 1728	2032	rundll32.exe	28
PID 2032 wrote to memory of 1728	2032	rundll32.exe	28
PID 2032 wrote to memory of 1728	2032	rundll32.exe	28
PID 2032 wrote to memory of 1728	2032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\204df8d00dcf85419965f7313595d3cc95a0363f98fa05433fb3d4e6d963265c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\204df8d00dcf85419965f7313595d3cc95a0363f98fa05433fb3d4e6d963265c.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1728

memory/1728-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download