gh0strat | 5933be513c5e449e1aa3a03c4eddd9d5940e9ea289a1624210527d99e6a7a6e3

Analysis

max time kernel
147s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 11:11

Target

5933be513c5e449e1aa3a03c4eddd9d5940e9ea289a1624210527d99e6a7a6e3.dll
Size

899KB
MD5

a9f818d018a5f7b83e9014ddec022594
SHA1

811ad482009dfb7f448be583817c17047ce3c963
SHA256

5933be513c5e449e1aa3a03c4eddd9d5940e9ea289a1624210527d99e6a7a6e3
SHA512

38dd1f0f9eb9b1753f2481d5bbcb77fd120c91666dd54bfdf19e8af51719090f24cd515ce1333339049bb6df2328e24a18bedfa09c114e699b40546dc9140943
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXa:7wqd87Va

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4624-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4624	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 4624	652	rundll32.exe	83
PID 652 wrote to memory of 4624	652	rundll32.exe	83
PID 652 wrote to memory of 4624	652	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5933be513c5e449e1aa3a03c4eddd9d5940e9ea289a1624210527d99e6a7a6e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5933be513c5e449e1aa3a03c4eddd9d5940e9ea289a1624210527d99e6a7a6e3.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4624

memory/4624-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download