gh0strat | 28911a331225656557c1b978008551e52b79e31b599915dd03c14da9f73781e6

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 21:36

Target

28911a331225656557c1b978008551e52b79e31b599915dd03c14da9f73781e6.dll
Size

51KB
MD5

15d4e961a0dbaff5a7aef67935ee12cb
SHA1

293c125a74375c794a3da97cfb13c5c2b9c33538
SHA256

28911a331225656557c1b978008551e52b79e31b599915dd03c14da9f73781e6
SHA512

2e5109e661ca63665c0741d6f2c2a6ef3d1aab36684d2d7ffd6f7f602618907d104470cf1a06f9b40aa4a90a4874012a6122da9558c7c262e0ac91ef20f5e947
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLwJYH5:1dWubF3n9S91BF3fbokJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4628-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4628	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 4628	3104	rundll32.exe	83
PID 3104 wrote to memory of 4628	3104	rundll32.exe	83
PID 3104 wrote to memory of 4628	3104	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\28911a331225656557c1b978008551e52b79e31b599915dd03c14da9f73781e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\28911a331225656557c1b978008551e52b79e31b599915dd03c14da9f73781e6.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4628

memory/4628-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download