gh0strat | e0610aa44464c319ed8575f7e396ed50a4e626c80cde289d21855a777a32fc91

Analysis

max time kernel
145s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 18:48

Target
e0610aa44464c319ed8575f7e396ed50a4e626c80cde289d21855a777a32fc91.dll
Size 51KB
Sample240613-xf8flasblm
SHA256 e0610aa44464c319ed8575f7e396ed50a4e626c80cde289d21855a777a32fc91
MD5 d53e57c8788c3a32ae71e1332c6f9f32
SHA1 b63ab08b50cb5c420e7ec324307a67e4cec6bfca
SHA512 44cc28826e245e2dccfa5e0a6c88b735c2a8c30f59bb9513ee5d4a4d5316d8b5509fd6c5473775f284ce9a7509f95a99668ae4960816564a4b8ef17f5d9e35f3
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL0JYH5:1dWubF3n9S91BF3fbo4JYH5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4952-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4952	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 4952	1644	rundll32.exe	82
PID 1644 wrote to memory of 4952	1644	rundll32.exe	82
PID 1644 wrote to memory of 4952	1644	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0610aa44464c319ed8575f7e396ed50a4e626c80cde289d21855a777a32fc91.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0610aa44464c319ed8575f7e396ed50a4e626c80cde289d21855a777a32fc91.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4952

memory/4952-0-0x0000000010000000-0x0000000010011000-memory.dmp

Download