gh0strat | 33bbb74ae1905776f4cc054a1ca9e617e326cadd33d40fef1406bc3f7217ce4e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 08:29

Target

33bbb74ae1905776f4cc054a1ca9e617e326cadd33d40fef1406bc3f7217ce4e.dll
Size

51KB
MD5

d4f9c71d2cb7b280bc68dd0d433a0ac6
SHA1

a934708736402610da523bf0e8f876b932d0a1a2
SHA256

33bbb74ae1905776f4cc054a1ca9e617e326cadd33d40fef1406bc3f7217ce4e
SHA512

b58ccd147e0341bfc35639160eb85acb0f455cd2cfa629280f27b961f1331c7809db854f4f86cc67ab570c395e0b68cd4489050b899598b2e4761aaf675eec03
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLYJYH5:1dWubF3n9S91BF3fbo0JYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3052-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3052	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 3052	1512	rundll32.exe	81
PID 1512 wrote to memory of 3052	1512	rundll32.exe	81
PID 1512 wrote to memory of 3052	1512	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33bbb74ae1905776f4cc054a1ca9e617e326cadd33d40fef1406bc3f7217ce4e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33bbb74ae1905776f4cc054a1ca9e617e326cadd33d40fef1406bc3f7217ce4e.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3052

memory/3052-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download