gh0strat | 58c80aff60a13734d66e6b044095bd26cb1b14d1854066487c9245f8ad4b103c

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 06:42

Target
58c80aff60a13734d66e6b044095bd26cb1b14d1854066487c9245f8ad4b103c.dll
Size 899KB
Sample240613-hgpmjssblm
SHA256 58c80aff60a13734d66e6b044095bd26cb1b14d1854066487c9245f8ad4b103c
MD5 02f688921549e80dec000645f9c41e47
SHA1 03a016d9b59d02570eb89fdee370492d814c7e3f
SHA512 f0acfaeb7e6d78ed5afb211d32fddd8a5267612a4f960141a83c113c5baf5c5db896428e71e28d5fc9b8aec818d3d565937948aba4f25f038cbd754f8413ec5f
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXn:7wqd87Vn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1176-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1176	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 1176	996	rundll32.exe	81
PID 996 wrote to memory of 1176	996	rundll32.exe	81
PID 996 wrote to memory of 1176	996	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58c80aff60a13734d66e6b044095bd26cb1b14d1854066487c9245f8ad4b103c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\58c80aff60a13734d66e6b044095bd26cb1b14d1854066487c9245f8ad4b103c.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1176

memory/1176-0-0x0000000010000000-0x000000001014F000-memory.dmp

Download