gh0strat | ca673e27f4350f52ea092d102525f29beca19fcc252cff982bc0ad35b2d03901

Analysis

max time kernel
141s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 02:28

Target

ca673e27f4350f52ea092d102525f29beca19fcc252cff982bc0ad35b2d03901.dll
Size

51KB
MD5

cd41356f7ac875940226bcc0dfbebfa1
SHA1

e8f44d71285608fff08375f641b2cd139277e9a2
SHA256

ca673e27f4350f52ea092d102525f29beca19fcc252cff982bc0ad35b2d03901
SHA512

8ee7e4539460908f61df9eb5702348d4fabf111073246ea3fec40ff03bcfc86ff9841e57cbef46ec4d79a3b56ddb41ad0b78c900f927ec007e2ef546a1815b4d
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+CJYH5:1dWubF3n9S91BF3fbohJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3616-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3616	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 3616	4400	rundll32.exe	82
PID 4400 wrote to memory of 3616	4400	rundll32.exe	82
PID 4400 wrote to memory of 3616	4400	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca673e27f4350f52ea092d102525f29beca19fcc252cff982bc0ad35b2d03901.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca673e27f4350f52ea092d102525f29beca19fcc252cff982bc0ad35b2d03901.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3616

memory/3616-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download