gh0strat | d1fbeee5a1d09573d9f88d79c08f683817a186e43e0d4c7107402e4bfec75e7e

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 18:49

Target
d1fbeee5a1d09573d9f88d79c08f683817a186e43e0d4c7107402e4bfec75e7e.dll
Size 51KB
Sample240613-xgk2pasbml
SHA256 d1fbeee5a1d09573d9f88d79c08f683817a186e43e0d4c7107402e4bfec75e7e
MD5 ca7ae5b15fad1577d00c658c3c9d252f
SHA1 e2b3abea23901910c49f9862c9f95bb59fda47de
SHA512 bb3ea97114f8bd438c2273221d5c5b3c8e5a3a1bb0e0cde46a7ae8011ac3c124d941cb4032011e43dbc82008f4dc60fdc5fa68bd390afebff6a5a2e3125ab488
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLBJYH5:1dWubF3n9S91BF3fbotJYH5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1112-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1112	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1112	2256	rundll32.exe	82
PID 2256 wrote to memory of 1112	2256	rundll32.exe	82
PID 2256 wrote to memory of 1112	2256	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1fbeee5a1d09573d9f88d79c08f683817a186e43e0d4c7107402e4bfec75e7e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1fbeee5a1d09573d9f88d79c08f683817a186e43e0d4c7107402e4bfec75e7e.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1112

memory/1112-0-0x0000000010000000-0x0000000010011000-memory.dmp

Download