gh0strat | 0b843dff1b57333c0d154c1608fb320a440589177f4e79e7219a512c515dc762

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 09:22

Target

0b843dff1b57333c0d154c1608fb320a440589177f4e79e7219a512c515dc762.dll
Size

899KB
MD5

03813f3da65d795a91060725970b8768
SHA1

a16c36aa4b058ed1e57f9be38cf16c17b7d62b41
SHA256

0b843dff1b57333c0d154c1608fb320a440589177f4e79e7219a512c515dc762
SHA512

389fa55c6dab76b268f1992ed011af672a8664feb506bdcb0960852c317a2d6fad589e8a25648692bf078a1c99e5a35ca0c3c998a4b8e45a18021a354a9cb011
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXn:7wqd87Vn

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2948-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2948	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2948	2944	rundll32.exe	28
PID 2944 wrote to memory of 2948	2944	rundll32.exe	28
PID 2944 wrote to memory of 2948	2944	rundll32.exe	28
PID 2944 wrote to memory of 2948	2944	rundll32.exe	28
PID 2944 wrote to memory of 2948	2944	rundll32.exe	28
PID 2944 wrote to memory of 2948	2944	rundll32.exe	28
PID 2944 wrote to memory of 2948	2944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b843dff1b57333c0d154c1608fb320a440589177f4e79e7219a512c515dc762.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b843dff1b57333c0d154c1608fb320a440589177f4e79e7219a512c515dc762.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2948

memory/2948-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download