gh0strat | 30080a45b061361d794b58fdd43bfafc3161252ff7019713b01f2d8db9856a1f

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 08:32

Target

30080a45b061361d794b58fdd43bfafc3161252ff7019713b01f2d8db9856a1f.dll
Size

51KB
MD5

1a65e6854330562844a24d606ce5b7c6
SHA1

dfb29cf4e0f41a87bf54bb1cd537bfc327df6589
SHA256

30080a45b061361d794b58fdd43bfafc3161252ff7019713b01f2d8db9856a1f
SHA512

afe54b761d0973bfe4de1c9f67ffe619e5230e3c5b26cf9ec48e0dfe8bd4d1b339a563d4ccda82dd06b479e4bd102307c4a0ef4dc0d4a1473f19e44525af87d9
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL3JYH5:1dWubF3n9S91BF3fboTJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/3040-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3040	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3040	3016	rundll32.exe	28
PID 3016 wrote to memory of 3040	3016	rundll32.exe	28
PID 3016 wrote to memory of 3040	3016	rundll32.exe	28
PID 3016 wrote to memory of 3040	3016	rundll32.exe	28
PID 3016 wrote to memory of 3040	3016	rundll32.exe	28
PID 3016 wrote to memory of 3040	3016	rundll32.exe	28
PID 3016 wrote to memory of 3040	3016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\30080a45b061361d794b58fdd43bfafc3161252ff7019713b01f2d8db9856a1f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\30080a45b061361d794b58fdd43bfafc3161252ff7019713b01f2d8db9856a1f.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3040

memory/3040-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download