gh0strat | 9c5c68ee1c6ab343f365171af64d646c7880ba7c646ef36e1db61efd4c32117a

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 09:32

Target

9c5c68ee1c6ab343f365171af64d646c7880ba7c646ef36e1db61efd4c32117a.dll
Size

51KB
MD5

bcf41fd47a4dfa18d7008266c2097927
SHA1

a051a8c1dacb15a9d2f49e052a550850b512193b
SHA256

9c5c68ee1c6ab343f365171af64d646c7880ba7c646ef36e1db61efd4c32117a
SHA512

b0427f28aaeaad631ecd594ea7d9c6f8c154fa1c7fa32fae4e70dc0a43f95c788a5a9448ca3e90b58cfc0dc1d8866f737af1aa09cbd692ce6f9c3bc7aa522033
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLDJYH5:1dWubF3n9S91BF3fbo/JYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2928-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2928	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2928	2908	rundll32.exe	28
PID 2908 wrote to memory of 2928	2908	rundll32.exe	28
PID 2908 wrote to memory of 2928	2908	rundll32.exe	28
PID 2908 wrote to memory of 2928	2908	rundll32.exe	28
PID 2908 wrote to memory of 2928	2908	rundll32.exe	28
PID 2908 wrote to memory of 2928	2908	rundll32.exe	28
PID 2908 wrote to memory of 2928	2908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c5c68ee1c6ab343f365171af64d646c7880ba7c646ef36e1db61efd4c32117a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9c5c68ee1c6ab343f365171af64d646c7880ba7c646ef36e1db61efd4c32117a.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2928

memory/2928-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download