gh0strat | 9b717a6ac9d1250ad3237100a2be94cd26c73cb3017d98283fb6e036deed1f02

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 08:20

Target

9b717a6ac9d1250ad3237100a2be94cd26c73cb3017d98283fb6e036deed1f02.dll
Size

899KB
MD5

9301119f0672c4c6e486521fc6372a45
SHA1

763d29e69c7c6b55222b437701b5a121803e9451
SHA256

9b717a6ac9d1250ad3237100a2be94cd26c73cb3017d98283fb6e036deed1f02
SHA512

810d19c52553d5f7e4818d46215378f043edeb5573477e59df414b043a8f1966a0e83afaa7f185358468153f19c1af1459582729558f49ccc97bf73b5ed1d0b9
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXT:7wqd87VT

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1576-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1576	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 1576	3360	rundll32.exe	83
PID 3360 wrote to memory of 1576	3360	rundll32.exe	83
PID 3360 wrote to memory of 1576	3360	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b717a6ac9d1250ad3237100a2be94cd26c73cb3017d98283fb6e036deed1f02.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b717a6ac9d1250ad3237100a2be94cd26c73cb3017d98283fb6e036deed1f02.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1576

memory/1576-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download