gh0strat | 38e972ecc422e09f9fbe326188b100a3542cea7dadc35063ae9c723bc48141dc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 10:01

Target

38e972ecc422e09f9fbe326188b100a3542cea7dadc35063ae9c723bc48141dc.dll
Size

899KB
MD5

6d3ab46fe88602d47ede7ad274039745
SHA1

54310a7d5ccc207c0df5b0108d335c2224e3b86e
SHA256

38e972ecc422e09f9fbe326188b100a3542cea7dadc35063ae9c723bc48141dc
SHA512

7a0bf1597573c302aea9f3ef581b44ff624ad49c4ea905c8f6afd430bb9e65417d8645a1e6752461d10eab3694ca86212d920c3a1c09929c81f59cb7bf18cfd9
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX8:7wqd87V8

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/4116-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4116	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 4116	2284	rundll32.exe	84
PID 2284 wrote to memory of 4116	2284	rundll32.exe	84
PID 2284 wrote to memory of 4116	2284	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38e972ecc422e09f9fbe326188b100a3542cea7dadc35063ae9c723bc48141dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38e972ecc422e09f9fbe326188b100a3542cea7dadc35063ae9c723bc48141dc.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4116

memory/4116-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download