gh0strat | 80714deb72c9e37ef4fa7cb9c1470bcc08c3b7101c1d54850e2e96fe78a2a27f

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 18:43

Target

80714deb72c9e37ef4fa7cb9c1470bcc08c3b7101c1d54850e2e96fe78a2a27f.dll
Size

899KB
MD5

f5f4b6642c982e1270c83c74fa3fc547
SHA1

c4cdd8c1b9f36d04f57eb401d41476017cce5cef
SHA256

80714deb72c9e37ef4fa7cb9c1470bcc08c3b7101c1d54850e2e96fe78a2a27f
SHA512

83577c788cded6049d253a132909e3731b5c1b7bee790eeccacf029eff85400bf63729e8acf818cb13a667827fdfb5cc0b8b6dd076483e6a7527d925dfe3d60c
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXG:7wqd87VG

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/3008-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3008	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 3008	2716	rundll32.exe	28
PID 2716 wrote to memory of 3008	2716	rundll32.exe	28
PID 2716 wrote to memory of 3008	2716	rundll32.exe	28
PID 2716 wrote to memory of 3008	2716	rundll32.exe	28
PID 2716 wrote to memory of 3008	2716	rundll32.exe	28
PID 2716 wrote to memory of 3008	2716	rundll32.exe	28
PID 2716 wrote to memory of 3008	2716	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80714deb72c9e37ef4fa7cb9c1470bcc08c3b7101c1d54850e2e96fe78a2a27f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\80714deb72c9e37ef4fa7cb9c1470bcc08c3b7101c1d54850e2e96fe78a2a27f.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3008

memory/3008-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download