gh0strat | 00146d2398a77c3123504f6cb59ae7432ecd740c66e26053124d85d95f2ee430

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:46

Target
00146d2398a77c3123504f6cb59ae7432ecd740c66e26053124d85d95f2ee430.dll
Size 899KB
Sample240612-2py1qstdqg
SHA256 00146d2398a77c3123504f6cb59ae7432ecd740c66e26053124d85d95f2ee430
MD5 c2c50f744503036a90a3e57f9483c266
SHA1 bcff15d6ca70c23e9f8338f0e6f5d386a393c083
SHA512 b784aa7c42149f08ea5fe03ade38c2733e36385a58bd228990680afbc07a3d441ffb2a16df06ee1d283b4e549754694524dbf2c76c6198ac0b575766cf0150e7
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXs:7wqd87Vs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3888-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3888	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 3888	4604	rundll32.exe	82
PID 4604 wrote to memory of 3888	4604	rundll32.exe	82
PID 4604 wrote to memory of 3888	4604	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00146d2398a77c3123504f6cb59ae7432ecd740c66e26053124d85d95f2ee430.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00146d2398a77c3123504f6cb59ae7432ecd740c66e26053124d85d95f2ee430.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3888

memory/3888-0-0x0000000010000000-0x000000001014F000-memory.dmp

Download