gh0strat | 1bcf4c46eea88cf8e363fe75fe423bb64cf58e0ee676d5a316e9559b5e3d8a19

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 05:59

Target

1bcf4c46eea88cf8e363fe75fe423bb64cf58e0ee676d5a316e9559b5e3d8a19.dll
Size

51KB
MD5

1d36032a55115729a60edfc78f6cef15
SHA1

340d94e95fa2fd8de961808884b1d43b17b3af35
SHA256

1bcf4c46eea88cf8e363fe75fe423bb64cf58e0ee676d5a316e9559b5e3d8a19
SHA512

14ac1d4f2d99779c138d4132586f5bdab4dad7b6f82848904cde458eda86b695bc31ac91ae3da8b124a49696f0292f3e87bc22df360ae059b695c37fa3fa480f
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLlJYH5:1dWubF3n9S91BF3fboJJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2936-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2936	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2936	2684	rundll32.exe	30
PID 2684 wrote to memory of 2936	2684	rundll32.exe	30
PID 2684 wrote to memory of 2936	2684	rundll32.exe	30
PID 2684 wrote to memory of 2936	2684	rundll32.exe	30
PID 2684 wrote to memory of 2936	2684	rundll32.exe	30
PID 2684 wrote to memory of 2936	2684	rundll32.exe	30
PID 2684 wrote to memory of 2936	2684	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bcf4c46eea88cf8e363fe75fe423bb64cf58e0ee676d5a316e9559b5e3d8a19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bcf4c46eea88cf8e363fe75fe423bb64cf58e0ee676d5a316e9559b5e3d8a19.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2936

memory/2936-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download