gh0strat | 993829564bffbff4ba1b4e4571271152016e37e45aa4bb85c262b15ad2b03ee0

Analysis

max time kernel
141s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:39

Target
993829564bffbff4ba1b4e4571271152016e37e45aa4bb85c262b15ad2b03ee0.dll
Size 51KB
Sample240612-2latqstckf
SHA256 993829564bffbff4ba1b4e4571271152016e37e45aa4bb85c262b15ad2b03ee0
MD5 d68f07dcf7420f42f0159a60f7f9c897
SHA1 533ec0718191008233853bb726949bdf40e4de36
SHA512 70ad6b443ec69725815db7e809e153d098d2888af7a4c261240a969de4acd4ed34f6d249997859cb670e1e4b03b96e1a3899d0111be5935b1eefe42a1640e375
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLMJYH5:1dWubF3n9S91BF3fboAJYH5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/5004-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5004	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 5004	3204	rundll32.exe	91
PID 3204 wrote to memory of 5004	3204	rundll32.exe	91
PID 3204 wrote to memory of 5004	3204	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\993829564bffbff4ba1b4e4571271152016e37e45aa4bb85c262b15ad2b03ee0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\993829564bffbff4ba1b4e4571271152016e37e45aa4bb85c262b15ad2b03ee0.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4380,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
1⤵
PID:2080

memory/5004-0-0x0000000010000000-0x0000000010011000-memory.dmp

Download