gh0strat | 45ae4139ffb47c49135d428b598bff5ee1609e6279c406861b970f5d00f5de45

Analysis

max time kernel
146s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 23:35

Target

45ae4139ffb47c49135d428b598bff5ee1609e6279c406861b970f5d00f5de45.dll
Size

899KB
MD5

67b5b16143f1e50974f8df2ac3e54faf
SHA1

7594d1f394e121fc750cd19b1a340b72fd7bf7cd
SHA256

45ae4139ffb47c49135d428b598bff5ee1609e6279c406861b970f5d00f5de45
SHA512

2a4a30a015faa6565a1cd229c91f083d1702b9ce8ee8f291ce5d3d61dc4e65079de8442c2c4d0a49dd9612583023646f10c3243a29e919188ad3666e00436c86
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXL:7wqd87VL

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/228-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
228	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 228	5068	rundll32.exe	82
PID 5068 wrote to memory of 228	5068	rundll32.exe	82
PID 5068 wrote to memory of 228	5068	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45ae4139ffb47c49135d428b598bff5ee1609e6279c406861b970f5d00f5de45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45ae4139ffb47c49135d428b598bff5ee1609e6279c406861b970f5d00f5de45.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:228

memory/228-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download