gh0strat | 6c07de9822925b047d89afef93cedc396f6117f2c5899b1e619f72406eaf26da

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 18:45

Target
6c07de9822925b047d89afef93cedc396f6117f2c5899b1e619f72406eaf26da.dll
Size 899KB
Sample240613-xecmjasark
SHA256 6c07de9822925b047d89afef93cedc396f6117f2c5899b1e619f72406eaf26da
MD5 9ff309c12067e61db1d37843bef0f4fb
SHA1 a37c6383dfb27263c1b8064d9a7b0d43e85f64e6
SHA512 eb9438f736ca9a8fa18e5873305d2f3d5f783efb9d548d451ea39d04e899486a3f9df9b9b2765fa560db44738b8c5eeb6a8194b370d8fc6f58885d50b1d4e733
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXY:7wqd87VY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1420-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1420	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1420	536	rundll32.exe	91
PID 536 wrote to memory of 1420	536	rundll32.exe	91
PID 536 wrote to memory of 1420	536	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c07de9822925b047d89afef93cedc396f6117f2c5899b1e619f72406eaf26da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c07de9822925b047d89afef93cedc396f6117f2c5899b1e619f72406eaf26da.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:2492

memory/1420-0-0x0000000010000000-0x000000001014F000-memory.dmp

Download