gh0strat | 20772c0317b3b673c875fda158e5df4ecd8f4abd3e0dc33084d762990fe1b4fb

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 22:29

Target

20772c0317b3b673c875fda158e5df4ecd8f4abd3e0dc33084d762990fe1b4fb.dll
Size

899KB
MD5

93b4e18a611d59383ce1edf81a7e5316
SHA1

d48cb49bc01c7639a83b3589aa3810e02323665e
SHA256

20772c0317b3b673c875fda158e5df4ecd8f4abd3e0dc33084d762990fe1b4fb
SHA512

d1b918965641ca8b65085d90276c2c0fce3a6ba12275efef229bf359a378b20983c7709d94746b300977c8f3824869f73481d1f405fd3d8fe77a76e4e4d7ab30
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXY:7wqd87VY

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1392-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1392	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 1392	4456	rundll32.exe	82
PID 4456 wrote to memory of 1392	4456	rundll32.exe	82
PID 4456 wrote to memory of 1392	4456	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\20772c0317b3b673c875fda158e5df4ecd8f4abd3e0dc33084d762990fe1b4fb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\20772c0317b3b673c875fda158e5df4ecd8f4abd3e0dc33084d762990fe1b4fb.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1392

memory/1392-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download