gh0strat | 60e7e8b355ae803d4bf33e006e1542e62a7036e0c892d048da47ec909e4e886d

Analysis

max time kernel
140s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 22:38

Target

60e7e8b355ae803d4bf33e006e1542e62a7036e0c892d048da47ec909e4e886d.dll
Size

899KB
MD5

da15bdb99381a721c902d31a091cc145
SHA1

006aed4dfe675e33b2131a4490e70c9ca9a6c517
SHA256

60e7e8b355ae803d4bf33e006e1542e62a7036e0c892d048da47ec909e4e886d
SHA512

fddd141a7a793db82a14442038b8ff5cfe8e20578c3000d4804507dab663ce07e32c0427a76d4c6ec5f0088ca5b8538bbdc6ac14fd80256a4fc4f95de0f8dac0
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXZ:7wqd87VZ

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/2516-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2516	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2516	1440	rundll32.exe	80
PID 1440 wrote to memory of 2516	1440	rundll32.exe	80
PID 1440 wrote to memory of 2516	1440	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60e7e8b355ae803d4bf33e006e1542e62a7036e0c892d048da47ec909e4e886d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\60e7e8b355ae803d4bf33e006e1542e62a7036e0c892d048da47ec909e4e886d.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2516

memory/2516-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download