gh0strat | e78f66b13e6ade91dc4c189f6b0f6df2f17765289588ac2a17175226e4dc93ae

Analysis

max time kernel
145s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:43

Target
e78f66b13e6ade91dc4c189f6b0f6df2f17765289588ac2a17175226e4dc93ae.dll
Size 899KB
Sample240612-2m76matdjc
SHA256 e78f66b13e6ade91dc4c189f6b0f6df2f17765289588ac2a17175226e4dc93ae
MD5 1893d0140464fdb1ddca86495a56a28e
SHA1 b20765137322beb746ca7946fe32a985f9636525
SHA512 4bfd4d1e671c223f31c18d43a5fba997ffe7099f089f8702dc692cb988c1536264d9de779bd4fb8e41ab817fed832158b03f7d551ccd55306011ff3f9771868d
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXw:7wqd87Vw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/640-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
640	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 640	3444	rundll32.exe	82
PID 3444 wrote to memory of 640	3444	rundll32.exe	82
PID 3444 wrote to memory of 640	3444	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e78f66b13e6ade91dc4c189f6b0f6df2f17765289588ac2a17175226e4dc93ae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e78f66b13e6ade91dc4c189f6b0f6df2f17765289588ac2a17175226e4dc93ae.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:640

memory/640-0-0x0000000010000000-0x000000001014F000-memory.dmp

Download