gh0strat | b7415a63b0e85342418a0c1cfc7f564b085caa08f98ceb65f0cff1ad1a5426e9

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 23:33

Target

b7415a63b0e85342418a0c1cfc7f564b085caa08f98ceb65f0cff1ad1a5426e9.dll
Size

51KB
MD5

d8a945b16388cfaf759d2ebdb69652d8
SHA1

5b062d949d4675a84eb57786302c3af605df662b
SHA256

b7415a63b0e85342418a0c1cfc7f564b085caa08f98ceb65f0cff1ad1a5426e9
SHA512

fe3916e32c40434eb4ea5c1870e51076f9a0dceb66036328a9290f22f9b227b03455f255d47bc8f22e87d99b66e410baeeb392e74cfe84c15be0f2cc0c25e4fb
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLoJYH5:1dWubF3n9S91BF3fbocJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1400-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1400	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 1400	3488	rundll32.exe	91
PID 3488 wrote to memory of 1400	3488	rundll32.exe	91
PID 3488 wrote to memory of 1400	3488	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7415a63b0e85342418a0c1cfc7f564b085caa08f98ceb65f0cff1ad1a5426e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7415a63b0e85342418a0c1cfc7f564b085caa08f98ceb65f0cff1ad1a5426e9.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:4536

memory/1400-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download