gh0strat | 5ab74981820f1513128d37a16563b5a61439b87c7e6fd8995d1a0d7497be5550

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 00:05

Target

5ab74981820f1513128d37a16563b5a61439b87c7e6fd8995d1a0d7497be5550.dll
Size

50KB
MD5

8e5ee7d741642529a5c58efcedd4f764
SHA1

1354ef0db8f4e072d0a82b1a1cb0f3280c7ff8d8
SHA256

5ab74981820f1513128d37a16563b5a61439b87c7e6fd8995d1a0d7497be5550
SHA512

c633cc27607e0f7f9b289c465fcd146eeacfac3340391d24bd62836329b19406ab62972a3f7d6ab31ba65425e1750f775188286e8b627ed2abe7b18bb2178f33
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5cJYH:W5ReWjTrW9rNPgYo+JYH

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2132-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2132	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2132	2600	rundll32.exe	28
PID 2600 wrote to memory of 2132	2600	rundll32.exe	28
PID 2600 wrote to memory of 2132	2600	rundll32.exe	28
PID 2600 wrote to memory of 2132	2600	rundll32.exe	28
PID 2600 wrote to memory of 2132	2600	rundll32.exe	28
PID 2600 wrote to memory of 2132	2600	rundll32.exe	28
PID 2600 wrote to memory of 2132	2600	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ab74981820f1513128d37a16563b5a61439b87c7e6fd8995d1a0d7497be5550.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ab74981820f1513128d37a16563b5a61439b87c7e6fd8995d1a0d7497be5550.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2132

memory/2132-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download