gh0strat | 61d08e6d8258e92214783bf7b20a7e26664f691fde268bc6d03d4909ee3222d6

Analysis

max time kernel
140s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 18:35

Target

61d08e6d8258e92214783bf7b20a7e26664f691fde268bc6d03d4909ee3222d6.dll
Size

899KB
MD5

623e9ff34dd2914b94b6406353cf48f0
SHA1

10996e230d22c49f6de56e87df38d3ea3e12cced
SHA256

61d08e6d8258e92214783bf7b20a7e26664f691fde268bc6d03d4909ee3222d6
SHA512

41f84d61bf62f80686cf39ed1f7b733b46f71c4c169705a40e1cc1e602f00f00161fddb5c6b0dbf1bbcd8fcb12661e8b6f9f77a47c1ff55cd34e2c4ed2b3fa93
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXT:7wqd87VT

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1388-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1388	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1388	4972	rundll32.exe	92
PID 4972 wrote to memory of 1388	4972	rundll32.exe	92
PID 4972 wrote to memory of 1388	4972	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\61d08e6d8258e92214783bf7b20a7e26664f691fde268bc6d03d4909ee3222d6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\61d08e6d8258e92214783bf7b20a7e26664f691fde268bc6d03d4909ee3222d6.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4452,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
1⤵
PID:2460

memory/1388-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download