gh0strat | 60e7e8b355ae803d4bf33e006e1542e62a7036e0c892d048da47ec909e4e886d

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 22:38

Target

60e7e8b355ae803d4bf33e006e1542e62a7036e0c892d048da47ec909e4e886d.dll
Size

899KB
MD5

da15bdb99381a721c902d31a091cc145
SHA1

006aed4dfe675e33b2131a4490e70c9ca9a6c517
SHA256

60e7e8b355ae803d4bf33e006e1542e62a7036e0c892d048da47ec909e4e886d
SHA512

fddd141a7a793db82a14442038b8ff5cfe8e20578c3000d4804507dab663ce07e32c0427a76d4c6ec5f0088ca5b8538bbdc6ac14fd80256a4fc4f95de0f8dac0
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXZ:7wqd87VZ

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2200-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2200	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2200	1992	rundll32.exe	28
PID 1992 wrote to memory of 2200	1992	rundll32.exe	28
PID 1992 wrote to memory of 2200	1992	rundll32.exe	28
PID 1992 wrote to memory of 2200	1992	rundll32.exe	28
PID 1992 wrote to memory of 2200	1992	rundll32.exe	28
PID 1992 wrote to memory of 2200	1992	rundll32.exe	28
PID 1992 wrote to memory of 2200	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60e7e8b355ae803d4bf33e006e1542e62a7036e0c892d048da47ec909e4e886d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60e7e8b355ae803d4bf33e006e1542e62a7036e0c892d048da47ec909e4e886d.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2200

memory/2200-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download