gh0strat | fbe7e340ac378178538bd1c1778f6a79a22369c1e20e9082b09bb5514ac76190

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 07:58

Target

fbe7e340ac378178538bd1c1778f6a79a22369c1e20e9082b09bb5514ac76190.dll
Size

51KB
MD5

5eac1c6122aaecebbd4bbc343e41d9bc
SHA1

1c4c98bba717e379cf185c81b6816df4b59c01e7
SHA256

fbe7e340ac378178538bd1c1778f6a79a22369c1e20e9082b09bb5514ac76190
SHA512

d862aad60627545e69b143072f5f51386f4024cf1ae788a8e0c002ac8087e47af02c0243d556a8f3ef084be526713269cf7e7e6ce405d976ad9e1d6f96b3953c
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL8JYH5:1dWubF3n9S91BF3fboQJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4928-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4928	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 4928	1668	rundll32.exe	84
PID 1668 wrote to memory of 4928	1668	rundll32.exe	84
PID 1668 wrote to memory of 4928	1668	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbe7e340ac378178538bd1c1778f6a79a22369c1e20e9082b09bb5514ac76190.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbe7e340ac378178538bd1c1778f6a79a22369c1e20e9082b09bb5514ac76190.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4928

memory/4928-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download