gh0strat | e51c4fa6ee60b9f183ff3e91bfc4a87194db92d7fbc2feb1cfe61434ae94c12b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 23:49

Target

e51c4fa6ee60b9f183ff3e91bfc4a87194db92d7fbc2feb1cfe61434ae94c12b.dll
Size

899KB
MD5

a10a402f5fb7f9a528182e9706529423
SHA1

5954e82e00de718b949d94d32a0aa09beef011e5
SHA256

e51c4fa6ee60b9f183ff3e91bfc4a87194db92d7fbc2feb1cfe61434ae94c12b
SHA512

2ec89169caa37568b273f2a4cf1992d4cee6a426d8d9f8ce868457eab2588485c736e497ed95d154c1bfffafc29b2198058a903957184e0b90a8274cb46b6c49
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXs:7wqd87Vs

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/3236-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3236	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 3236	5080	rundll32.exe	84
PID 5080 wrote to memory of 3236	5080	rundll32.exe	84
PID 5080 wrote to memory of 3236	5080	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e51c4fa6ee60b9f183ff3e91bfc4a87194db92d7fbc2feb1cfe61434ae94c12b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e51c4fa6ee60b9f183ff3e91bfc4a87194db92d7fbc2feb1cfe61434ae94c12b.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3236

memory/3236-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download