gh0strat | f33989e3e969e484297b6b08ccdc2bae110307b0f1a5025d3520c963fd0c7631

Analysis

max time kernel
145s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 18:43

Target

f33989e3e969e484297b6b08ccdc2bae110307b0f1a5025d3520c963fd0c7631.dll
Size

51KB
MD5

5bd6671695a466f52cafd3542e898ca8
SHA1

c6aa494e442c1fc5ed674db475369866d3b35619
SHA256

f33989e3e969e484297b6b08ccdc2bae110307b0f1a5025d3520c963fd0c7631
SHA512

7ace8caef1f490643578a86bb9ee6793b0a86192cded9e74dbdfe75c497f90b24647aaaa2f587f104891aeb2893134d5f89ba2f1d07f34161bb2c444aa0104e9
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLNJYH5:1dWubF3n9S91BF3fbo5JYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4380-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4380	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 4380	940	rundll32.exe	80
PID 940 wrote to memory of 4380	940	rundll32.exe	80
PID 940 wrote to memory of 4380	940	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f33989e3e969e484297b6b08ccdc2bae110307b0f1a5025d3520c963fd0c7631.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f33989e3e969e484297b6b08ccdc2bae110307b0f1a5025d3520c963fd0c7631.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4380

memory/4380-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download