gh0strat | 4108f1f3730b98f65787d7f2a15a3b0a6749f6cb4f45197f221b5688c720aa24

Analysis

max time kernel
142s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 07:22

Target

4108f1f3730b98f65787d7f2a15a3b0a6749f6cb4f45197f221b5688c720aa24.dll
Size

899KB
MD5

8ef772d54f9f7abd3d64c094934a3af0
SHA1

45136419c7a83f97f19d686e05dde1b761ac646d
SHA256

4108f1f3730b98f65787d7f2a15a3b0a6749f6cb4f45197f221b5688c720aa24
SHA512

c9f56d34ab0eb457f2a23ca135ba815b45c2804fea9f560abd1866048634ef62de2fad0dd3284194c378082691522cbc5bf4836001ce82675e46558f9df55cc8
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXx:7wqd87Vx

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/5024-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5024	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 5024	2300	rundll32.exe	82
PID 2300 wrote to memory of 5024	2300	rundll32.exe	82
PID 2300 wrote to memory of 5024	2300	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4108f1f3730b98f65787d7f2a15a3b0a6749f6cb4f45197f221b5688c720aa24.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4108f1f3730b98f65787d7f2a15a3b0a6749f6cb4f45197f221b5688c720aa24.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:5024

memory/5024-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download