gh0strat | e19a07c5192d6a5b9e6923afc959af8702faeb86481bf35040d5a7f8f8acace1

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 23:49

Target
e19a07c5192d6a5b9e6923afc959af8702faeb86481bf35040d5a7f8f8acace1.dll
Size 51KB
Sample240612-3ve1gswbpg
SHA256 e19a07c5192d6a5b9e6923afc959af8702faeb86481bf35040d5a7f8f8acace1
MD5 d9514c9e35538cbdcd6aefa0fcb78294
SHA1 eefa7f1eda03debc85657f5a166aa09b33b9e8ae
SHA512 dc8ad3d1d1c89d515ac0fd66e9496dc37f183b1dcfc25104911fe5e6216da7f90f7765cdd435a64b460c5e775a12b4364914945d356f8095a974f0c3f9029106
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLBJYH5:1dWubF3n9S91BF3fboVJYH5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/224-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
224	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 224	2916	rundll32.exe	82
PID 2916 wrote to memory of 224	2916	rundll32.exe	82
PID 2916 wrote to memory of 224	2916	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e19a07c5192d6a5b9e6923afc959af8702faeb86481bf35040d5a7f8f8acace1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e19a07c5192d6a5b9e6923afc959af8702faeb86481bf35040d5a7f8f8acace1.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:224

memory/224-0-0x0000000010000000-0x0000000010011000-memory.dmp

Download