gh0strat | 1c8ff2fb4e004a9dd097893f21277d030f2e3feb053e44dd02de9a03661b1b03

Analysis

max time kernel
140s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 05:49

Target

1c8ff2fb4e004a9dd097893f21277d030f2e3feb053e44dd02de9a03661b1b03.dll
Size

899KB
MD5

97e6912bcd8cda60ad481f928a479f56
SHA1

51eeaeb72c68927b21a4d8b6fe4f2d9ba4552a4f
SHA256

1c8ff2fb4e004a9dd097893f21277d030f2e3feb053e44dd02de9a03661b1b03
SHA512

4b894dc66dad6fba9abb1c1a05484e7e41483f07907610e5987f88ba18cd9fd086ec44df5bd1dddb603d0fcdc8a0a958bc9da91b8f4689bec73414d736d2b038
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXX:7wqd87VX

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2560-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2560	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2560	2088	rundll32.exe	30
PID 2088 wrote to memory of 2560	2088	rundll32.exe	30
PID 2088 wrote to memory of 2560	2088	rundll32.exe	30
PID 2088 wrote to memory of 2560	2088	rundll32.exe	30
PID 2088 wrote to memory of 2560	2088	rundll32.exe	30
PID 2088 wrote to memory of 2560	2088	rundll32.exe	30
PID 2088 wrote to memory of 2560	2088	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c8ff2fb4e004a9dd097893f21277d030f2e3feb053e44dd02de9a03661b1b03.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c8ff2fb4e004a9dd097893f21277d030f2e3feb053e44dd02de9a03661b1b03.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2560

memory/2560-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download