gh0strat | 83250e4c42c8c10ad1885bc65b169fae887b5a3d93902fa6ef317aacf502af6e

Analysis

max time kernel
144s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 20:15

Target

83250e4c42c8c10ad1885bc65b169fae887b5a3d93902fa6ef317aacf502af6e.dll
Size

899KB
MD5

20f226879bc28a449877e87ff25ac9aa
SHA1

e432c8c0c412c77d95697064eb4fc413d7ed5cc3
SHA256

83250e4c42c8c10ad1885bc65b169fae887b5a3d93902fa6ef317aacf502af6e
SHA512

70e0cabd4e8684d97d4d64ca000d7d3d70b1106c379fe1a96c527eb1f75d5ec61a3052049c7fe5faec04be323f0710b52b7d09dc34735ac3f132975ee12c981b
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXL:7wqd87VL

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1164-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1164	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1164	1696	rundll32.exe	81
PID 1696 wrote to memory of 1164	1696	rundll32.exe	81
PID 1696 wrote to memory of 1164	1696	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83250e4c42c8c10ad1885bc65b169fae887b5a3d93902fa6ef317aacf502af6e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\83250e4c42c8c10ad1885bc65b169fae887b5a3d93902fa6ef317aacf502af6e.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1164

memory/1164-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download