gh0strat | 9064297e5606834f7da5ae0df7e63a9b47b9ec6912ba98d33d1e4bca8ba6c323

Analysis

max time kernel
143s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 00:45

Target
9064297e5606834f7da5ae0df7e63a9b47b9ec6912ba98d33d1e4bca8ba6c323.dll
Size 51KB
Sample240613-a4e3ma1fjp
SHA256 9064297e5606834f7da5ae0df7e63a9b47b9ec6912ba98d33d1e4bca8ba6c323
MD5 31f5d669d28c9f312eb4d633830acd14
SHA1 24472adbbaefd0a52260e40d21bf05d66cb3fcac
SHA512 8fc9bd748dcdae56ca8259039bdd10a1c67e4efa351151c6c96327b9f7e857d168ba32cc55d4e0ca572e6de13c5df3e2384ad93a0faa94c083cc9d08ffeed57f
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLOJYH5:1dWubF3n9S91BF3fboaJYH5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/376-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
376	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 376	2968	rundll32.exe	82
PID 2968 wrote to memory of 376	2968	rundll32.exe	82
PID 2968 wrote to memory of 376	2968	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9064297e5606834f7da5ae0df7e63a9b47b9ec6912ba98d33d1e4bca8ba6c323.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9064297e5606834f7da5ae0df7e63a9b47b9ec6912ba98d33d1e4bca8ba6c323.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:376

memory/376-0-0x0000000010000000-0x0000000010011000-memory.dmp

Download