gh0strat | 0591435f6c6be79f9298d7b63eae888d5ac5dd6b1ce115e8dd43d9652781c6e3

Analysis

max time kernel
146s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 22:40

Target
0591435f6c6be79f9298d7b63eae888d5ac5dd6b1ce115e8dd43d9652781c6e3.dll
Size 51KB
Sample240613-2ljrmstbre
SHA256 0591435f6c6be79f9298d7b63eae888d5ac5dd6b1ce115e8dd43d9652781c6e3
MD5 f3661e3e4bacc485d91fba5423dcb7d2
SHA1 ff1595bd4806e0ddfb1e676fc3dc6922f7def8cb
SHA512 ea7b13cc936eb64ca0c64c751b3542745e087996775988f01935cc3d859b54c4286e93a99a78a80643676c25cc1acf47c303854e091c27ebf76f5f45a6aed4cd
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLeJYH5:1dWubF3n9S91BF3fboiJYH5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/100-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
100	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 100	2568	rundll32.exe	82
PID 2568 wrote to memory of 100	2568	rundll32.exe	82
PID 2568 wrote to memory of 100	2568	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0591435f6c6be79f9298d7b63eae888d5ac5dd6b1ce115e8dd43d9652781c6e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0591435f6c6be79f9298d7b63eae888d5ac5dd6b1ce115e8dd43d9652781c6e3.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:100

memory/100-0-0x0000000010000000-0x0000000010011000-memory.dmp

Download