gh0strat | 3a84cdb817cb97904769624af4e449403bdba2b425932fd832264f03cbe5ad89

Analysis

max time kernel
148s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 02:41

Target

3a84cdb817cb97904769624af4e449403bdba2b425932fd832264f03cbe5ad89.dll
Size

51KB
MD5

4830a532add3c60108e9550b9db46785
SHA1

2a2a4cce2e15806c75cffe7172ba950b13b00e42
SHA256

3a84cdb817cb97904769624af4e449403bdba2b425932fd832264f03cbe5ad89
SHA512

a9c97f65a15fd013375563af0994944a2790d4e2fadab38e9e62599b9c0887dd20b029c46261ce64afff29ba657afeb03d29fc364f4d1bf46c12eeed4e9f3c8a
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLAJYH5:1dWubF3n9S91BF3fbo0JYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3172-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3172	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 3172	3472	rundll32.exe	82
PID 3472 wrote to memory of 3172	3472	rundll32.exe	82
PID 3472 wrote to memory of 3172	3472	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a84cdb817cb97904769624af4e449403bdba2b425932fd832264f03cbe5ad89.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a84cdb817cb97904769624af4e449403bdba2b425932fd832264f03cbe5ad89.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3172

memory/3172-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download