gh0strat | 9a1ff201c3b7f3aec2c9652bfd66d3e53aad28ebdbeb54609a5256650be70783

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 15:15

Target

9a1ff201c3b7f3aec2c9652bfd66d3e53aad28ebdbeb54609a5256650be70783.dll
Size

899KB
MD5

d63ad734e02756fc217a525810f92cd1
SHA1

21b364ad6b58ed993c7178cc4aa193d949231963
SHA256

9a1ff201c3b7f3aec2c9652bfd66d3e53aad28ebdbeb54609a5256650be70783
SHA512

f4cba6b0cd437d233ab541c3c589ec70cacb6febaecf31d4cd3e7e92d59e6b4217063aed4cf38b17fb76f6ae90987bbc7b9a2608a719411b33e717165373d2f9
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXD:7wqd87VD

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1680-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1680	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1680	2756	rundll32.exe	28
PID 2756 wrote to memory of 1680	2756	rundll32.exe	28
PID 2756 wrote to memory of 1680	2756	rundll32.exe	28
PID 2756 wrote to memory of 1680	2756	rundll32.exe	28
PID 2756 wrote to memory of 1680	2756	rundll32.exe	28
PID 2756 wrote to memory of 1680	2756	rundll32.exe	28
PID 2756 wrote to memory of 1680	2756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a1ff201c3b7f3aec2c9652bfd66d3e53aad28ebdbeb54609a5256650be70783.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a1ff201c3b7f3aec2c9652bfd66d3e53aad28ebdbeb54609a5256650be70783.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1680

memory/1680-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download