gh0strat | 224a1bad2ee3d8fc32d5b748f4b8b182582485ae86e5965f64f0c05255609ea0

Analysis

max time kernel
142s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 18:55

Target

224a1bad2ee3d8fc32d5b748f4b8b182582485ae86e5965f64f0c05255609ea0.dll
Size

51KB
MD5

126f94c0cc603d8ea06b4f13b7a2ba76
SHA1

252f509de654abf7a720c7aaa9d7e17a2fc39f75
SHA256

224a1bad2ee3d8fc32d5b748f4b8b182582485ae86e5965f64f0c05255609ea0
SHA512

31e324b52b6386f14c138fade21d47b40fb1c09459c9f9d4ce2175c428b3cbe55748a850aa6df15b7c258f9fd8269f4705aa718c8d489f08d429d653c83a0263
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+9JYH5:1dWubF3n9S91BF3fbo6JYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/2312-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2312	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2312	1140	rundll32.exe	81
PID 1140 wrote to memory of 2312	1140	rundll32.exe	81
PID 1140 wrote to memory of 2312	1140	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\224a1bad2ee3d8fc32d5b748f4b8b182582485ae86e5965f64f0c05255609ea0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\224a1bad2ee3d8fc32d5b748f4b8b182582485ae86e5965f64f0c05255609ea0.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2312

memory/2312-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download