gh0strat | a6e864f59e9c6d3fc14ab8d2e09949a23f9b26d43929d52619fd55d9d29b222f

Analysis

max time kernel
144s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 21:36

Target
a6e864f59e9c6d3fc14ab8d2e09949a23f9b26d43929d52619fd55d9d29b222f.dll
Size 899KB
Sample240612-1f6tjsvepl
SHA256 a6e864f59e9c6d3fc14ab8d2e09949a23f9b26d43929d52619fd55d9d29b222f
MD5 3a83b9e3895bd02499b6b10cb8581367
SHA1 55db243543dab5708cd4cb32b4e9a07c32f0d8d2
SHA512 7fd13ca073b8c07a19e3b3c5db0bfc41d2ba0e51af768061509171040ebac0b4dbffd13c629b1b400f8871a5be329a49b459486c23f5566faedaa412a18c3edf
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXp:7wqd87Vp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3952-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3952	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3952	2724	rundll32.exe	82
PID 2724 wrote to memory of 3952	2724	rundll32.exe	82
PID 2724 wrote to memory of 3952	2724	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6e864f59e9c6d3fc14ab8d2e09949a23f9b26d43929d52619fd55d9d29b222f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a6e864f59e9c6d3fc14ab8d2e09949a23f9b26d43929d52619fd55d9d29b222f.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3952

memory/3952-0-0x0000000010000000-0x000000001014F000-memory.dmp

Download