gh0strat | 421ba34ba858a792705ae3f08a09a64b36f4befd93ad5edd3053ba18aa5d065a

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 23:35

Target

421ba34ba858a792705ae3f08a09a64b36f4befd93ad5edd3053ba18aa5d065a.dll
Size

899KB
MD5

c6168b20ad1d79c9f8d4a936df1854a3
SHA1

5f70e31c9f3c7f32f383172c2840e426b0cc0a13
SHA256

421ba34ba858a792705ae3f08a09a64b36f4befd93ad5edd3053ba18aa5d065a
SHA512

881c6454db3fdf6457a89690027a3a08ec42f10bc759cd70c37d816f97de35901df1573c1134f906beb6940d71b5c47756f552103a9681ea1adba4d41ca596d5
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXH:7wqd87VH

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2296-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2296	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2296	1808	rundll32.exe	28
PID 1808 wrote to memory of 2296	1808	rundll32.exe	28
PID 1808 wrote to memory of 2296	1808	rundll32.exe	28
PID 1808 wrote to memory of 2296	1808	rundll32.exe	28
PID 1808 wrote to memory of 2296	1808	rundll32.exe	28
PID 1808 wrote to memory of 2296	1808	rundll32.exe	28
PID 1808 wrote to memory of 2296	1808	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\421ba34ba858a792705ae3f08a09a64b36f4befd93ad5edd3053ba18aa5d065a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\421ba34ba858a792705ae3f08a09a64b36f4befd93ad5edd3053ba18aa5d065a.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2296

memory/2296-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download