gh0strat | 38c9414506fefbe70b4735f0e6d64a49e5912c3aae6dee35499a2b5b04c6a2cd

Analysis

max time kernel
147s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 07:36

Target

38c9414506fefbe70b4735f0e6d64a49e5912c3aae6dee35499a2b5b04c6a2cd.dll
Size

51KB
MD5

0468734a0a05b60d491b29be7f123a91
SHA1

4cfcc45e758ad9a2f143a6133acf54a0b998f7c8
SHA256

38c9414506fefbe70b4735f0e6d64a49e5912c3aae6dee35499a2b5b04c6a2cd
SHA512

8a4cc4f8b84b0612adee63cdf1b5d6d155fe36edf509be237470b868ea42c270dd0a7ad27d74bc769c8f64bfe0ca7958ded3589e80c6e59fca91f051f4b773e4
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL2JYH5:1dWubF3n9S91BF3fboqJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3752-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3752	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 3752	716	rundll32.exe	81
PID 716 wrote to memory of 3752	716	rundll32.exe	81
PID 716 wrote to memory of 3752	716	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c9414506fefbe70b4735f0e6d64a49e5912c3aae6dee35499a2b5b04c6a2cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38c9414506fefbe70b4735f0e6d64a49e5912c3aae6dee35499a2b5b04c6a2cd.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3752

memory/3752-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download