gh0strat | 17a0aca13acb064daa46acb354efcfda8ea15640780bba2c991f2b79a701d0f2

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 19:52

Target
17a0aca13acb064daa46acb354efcfda8ea15640780bba2c991f2b79a701d0f2.dll
Size 51KB
Sample240613-ylcfsayfnd
SHA256 17a0aca13acb064daa46acb354efcfda8ea15640780bba2c991f2b79a701d0f2
MD5 2b7507939f3831dc517bf9bce67f7f0b
SHA1 b0df385cc41d20451b9cd5e1fb76ba3ddf38af46
SHA512 3bef6dbc0374012ac14c51e1f68b8b1a5da14e71e42fb32df9c191e8e01ead8e894fa45d32ee92b2dad00da0f62bb17b91e9945266ec75df08ec74f91ab63ee0
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLSJYH5:1dWubF3n9S91BF3fboeJYH5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Family

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2096-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2096	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2096	2108	rundll32.exe	29
PID 2108 wrote to memory of 2096	2108	rundll32.exe	29
PID 2108 wrote to memory of 2096	2108	rundll32.exe	29
PID 2108 wrote to memory of 2096	2108	rundll32.exe	29
PID 2108 wrote to memory of 2096	2108	rundll32.exe	29
PID 2108 wrote to memory of 2096	2108	rundll32.exe	29
PID 2108 wrote to memory of 2096	2108	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17a0aca13acb064daa46acb354efcfda8ea15640780bba2c991f2b79a701d0f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17a0aca13acb064daa46acb354efcfda8ea15640780bba2c991f2b79a701d0f2.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2096

memory/2096-0-0x0000000010000000-0x0000000010011000-memory.dmp

Download