gh0strat | 5a84c1d661c8c85f9f60e936029881db668ffe266546494322cd53dcdf123e22

Analysis

max time kernel
140s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 10:07

Target

5a84c1d661c8c85f9f60e936029881db668ffe266546494322cd53dcdf123e22.dll
Size

51KB
MD5

ca1ff709bd8fa6397f3320f0826f1799
SHA1

1ad8a37cada769c12e319264b897ee5a80bc3dc1
SHA256

5a84c1d661c8c85f9f60e936029881db668ffe266546494322cd53dcdf123e22
SHA512

56f33394cabc10f143a34c92f92bb762b3877368e66696c7c14bb99cde6cc32259917e2c4ed62b714517eef932872c94e0f5272f407d60fd752830138870553b
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLEJYH5:1dWubF3n9S91BF3fbogJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2408-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2408	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2408	2552	rundll32.exe	30
PID 2552 wrote to memory of 2408	2552	rundll32.exe	30
PID 2552 wrote to memory of 2408	2552	rundll32.exe	30
PID 2552 wrote to memory of 2408	2552	rundll32.exe	30
PID 2552 wrote to memory of 2408	2552	rundll32.exe	30
PID 2552 wrote to memory of 2408	2552	rundll32.exe	30
PID 2552 wrote to memory of 2408	2552	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a84c1d661c8c85f9f60e936029881db668ffe266546494322cd53dcdf123e22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a84c1d661c8c85f9f60e936029881db668ffe266546494322cd53dcdf123e22.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2408

memory/2408-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download