gh0strat | 59561bc163018b219c133de068d0797bb9e3ba82f3f67936d7c47aa835fc615f

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 00:48

Target

59561bc163018b219c133de068d0797bb9e3ba82f3f67936d7c47aa835fc615f.dll
Size

899KB
MD5

dc2c7fb2c3b24841bf7ed3e64c9a0ce8
SHA1

c3b5345a6161864384b2483a7b00945916636027
SHA256

59561bc163018b219c133de068d0797bb9e3ba82f3f67936d7c47aa835fc615f
SHA512

2f7d5bcab00a4855efea2dbd65853fa1a2cfd39b8650b086853f89f62c2e39a6527e9b40ff849be0e1322b523921863c49c008c3c94890bf6f4da2c7f14c153d
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX2:7wqd87V2

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2892-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2892	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2892	624	rundll32.exe	28
PID 624 wrote to memory of 2892	624	rundll32.exe	28
PID 624 wrote to memory of 2892	624	rundll32.exe	28
PID 624 wrote to memory of 2892	624	rundll32.exe	28
PID 624 wrote to memory of 2892	624	rundll32.exe	28
PID 624 wrote to memory of 2892	624	rundll32.exe	28
PID 624 wrote to memory of 2892	624	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59561bc163018b219c133de068d0797bb9e3ba82f3f67936d7c47aa835fc615f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59561bc163018b219c133de068d0797bb9e3ba82f3f67936d7c47aa835fc615f.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2892

memory/2892-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download