gh0strat | 3ac10bf72887810cd640f02969a665a5be1ac23542891d9e2346f26461867a91

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2024 03:34

Target

3ac10bf72887810cd640f02969a665a5be1ac23542891d9e2346f26461867a91.dll
Size

50KB
MD5

4f8d2f83f4fe7246f2321e3e64fe1e1b
SHA1

b958da380dcbb56b6cc0c0ad5bf64c4b12043f4a
SHA256

3ac10bf72887810cd640f02969a665a5be1ac23542891d9e2346f26461867a91
SHA512

d60d846eb33e402a96f4a49744880ba6ff057d55382d649e1c0490a5b6ee7f45c33c1a6bab185c795c371d1fa70a93b2150ed1caa95e41aa1844d8219a4b842b
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5oJYH:W5ReWjTrW9rNPgYomJYH

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/2004-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2004	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 2004	4840	rundll32.exe	81
PID 4840 wrote to memory of 2004	4840	rundll32.exe	81
PID 4840 wrote to memory of 2004	4840	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ac10bf72887810cd640f02969a665a5be1ac23542891d9e2346f26461867a91.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ac10bf72887810cd640f02969a665a5be1ac23542891d9e2346f26461867a91.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2004

memory/2004-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download