gh0strat | 0f138cf31df85137fc7d0b543f6c49a8e89b8d3ff7c3eff18cde97d79d116dc0

Analysis

max time kernel
148s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 00:39

Target
0f138cf31df85137fc7d0b543f6c49a8e89b8d3ff7c3eff18cde97d79d116dc0.dll
Size 50KB
Sample240613-azydea1dnq
SHA256 0f138cf31df85137fc7d0b543f6c49a8e89b8d3ff7c3eff18cde97d79d116dc0
MD5 607baea64b358d5a47208b99a3474e4d
SHA1 5b2450a31840774ef09046b92d3c798fa0cedd6a
SHA512 4639e90f562ecd42a0ab137f581e19b8650dfeb6dd2b752aa43c14e21a397c6bdbe31db7af61bd67a6ef3df459d334ef8506ae8284a0079201ee3f4804af14a1
SSDEEP 1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5RJYH:W5ReWjTrW9rNPgYonJYH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3572-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3572	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 3572	3932	rundll32.exe	81
PID 3932 wrote to memory of 3572	3932	rundll32.exe	81
PID 3932 wrote to memory of 3572	3932	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f138cf31df85137fc7d0b543f6c49a8e89b8d3ff7c3eff18cde97d79d116dc0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f138cf31df85137fc7d0b543f6c49a8e89b8d3ff7c3eff18cde97d79d116dc0.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3572

memory/3572-0-0x0000000010000000-0x0000000010011000-memory.dmp

Download