gh0strat | 11bb8e1db56e96f2e6fd98dae2ea5bc425b9276eaff9395de134c5267115ef22

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23/06/2024, 23:45

Target

11bb8e1db56e96f2e6fd98dae2ea5bc425b9276eaff9395de134c5267115ef22.dll
Size

50KB
MD5

88642724632e5b772f07cd3dd578cf6b
SHA1

feeca835fab584566d3bf83f7a1cdc1eba1d41ee
SHA256

11bb8e1db56e96f2e6fd98dae2ea5bc425b9276eaff9395de134c5267115ef22
SHA512

3b5a12a8cde8398e6c52b413975cc8189ec1423a3ac397dd5fb8e9bc09f4f5a743dfffa2eed5a70dd2889e0dc869c99920e54cc2e8cfd9ba0f31d60120635961
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5IJYH:W5ReWjTrW9rNPgYoaJYH

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2208-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2208	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2208	2240	rundll32.exe	28
PID 2240 wrote to memory of 2208	2240	rundll32.exe	28
PID 2240 wrote to memory of 2208	2240	rundll32.exe	28
PID 2240 wrote to memory of 2208	2240	rundll32.exe	28
PID 2240 wrote to memory of 2208	2240	rundll32.exe	28
PID 2240 wrote to memory of 2208	2240	rundll32.exe	28
PID 2240 wrote to memory of 2208	2240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11bb8e1db56e96f2e6fd98dae2ea5bc425b9276eaff9395de134c5267115ef22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11bb8e1db56e96f2e6fd98dae2ea5bc425b9276eaff9395de134c5267115ef22.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2208

memory/2208-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download