gh0strat | 30080a45b061361d794b58fdd43bfafc3161252ff7019713b01f2d8db9856a1f

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:32

Target

30080a45b061361d794b58fdd43bfafc3161252ff7019713b01f2d8db9856a1f.dll
Size

51KB
MD5

1a65e6854330562844a24d606ce5b7c6
SHA1

dfb29cf4e0f41a87bf54bb1cd537bfc327df6589
SHA256

30080a45b061361d794b58fdd43bfafc3161252ff7019713b01f2d8db9856a1f
SHA512

afe54b761d0973bfe4de1c9f67ffe619e5230e3c5b26cf9ec48e0dfe8bd4d1b339a563d4ccda82dd06b479e4bd102307c4a0ef4dc0d4a1473f19e44525af87d9
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL3JYH5:1dWubF3n9S91BF3fboTJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4620-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4620	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 4620	5012	rundll32.exe	93
PID 5012 wrote to memory of 4620	5012	rundll32.exe	93
PID 5012 wrote to memory of 4620	5012	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\30080a45b061361d794b58fdd43bfafc3161252ff7019713b01f2d8db9856a1f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\30080a45b061361d794b58fdd43bfafc3161252ff7019713b01f2d8db9856a1f.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:2532

memory/4620-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download