gh0strat | da1289ac4e2582e29993e50089a483aa909bbc6d47f2ee46b903163274edd0c3

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 02:29

Target

da1289ac4e2582e29993e50089a483aa909bbc6d47f2ee46b903163274edd0c3.dll
Size

51KB
MD5

88e5dca27ac463060c49767d25b058d1
SHA1

560eee10c0ce0e558d280d399a5b63157cadf2e4
SHA256

da1289ac4e2582e29993e50089a483aa909bbc6d47f2ee46b903163274edd0c3
SHA512

72a352d2397b6c935d6e74307f56b485febe363bf01cf37e9334821f7abf0c8cdc8c176278e41c6630683b526b54b4bafed2edd6e83135e9abcaf900450ba1ca
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL/JYH5:1dWubF3n9S91BF3fbozJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4580-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4580	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 4580	1520	rundll32.exe	80
PID 1520 wrote to memory of 4580	1520	rundll32.exe	80
PID 1520 wrote to memory of 4580	1520	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da1289ac4e2582e29993e50089a483aa909bbc6d47f2ee46b903163274edd0c3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da1289ac4e2582e29993e50089a483aa909bbc6d47f2ee46b903163274edd0c3.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4580

memory/4580-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download