gh0strat | 6982b777acfe1f5c3598fb9f142ec0ca5d96f364c565897781606df85275c6ae

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 07:13

Target

6982b777acfe1f5c3598fb9f142ec0ca5d96f364c565897781606df85275c6ae.dll
Size

51KB
MD5

caa3c2ac71ef0a3da5dab3224aab0fc0
SHA1

54cb728c118bbcd07330ad375c9000051ea82384
SHA256

6982b777acfe1f5c3598fb9f142ec0ca5d96f364c565897781606df85275c6ae
SHA512

d478792bd51ec382b247a8830fc43023dafa184eb0bb4bcbedbd44672fbba44d21cbd0375f72b7f619de26ba3d5e3d5b29106234ad1efce504e491991cd0278b
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLcJYH5:1dWubF3n9S91BF3fboQJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1612-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1612	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 1612	3808	rundll32.exe	84
PID 3808 wrote to memory of 1612	3808	rundll32.exe	84
PID 3808 wrote to memory of 1612	3808	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6982b777acfe1f5c3598fb9f142ec0ca5d96f364c565897781606df85275c6ae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6982b777acfe1f5c3598fb9f142ec0ca5d96f364c565897781606df85275c6ae.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1612

memory/1612-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download