gh0strat | 699abbdd10a3b0d9e8f85c53dab0dababf8e0025cd3567387a3dc3a523cd95dc

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 23:02

Target

699abbdd10a3b0d9e8f85c53dab0dababf8e0025cd3567387a3dc3a523cd95dc.dll
Size

899KB
MD5

aee9ee2fe42a02096bce7ca395b4baa9
SHA1

96578303b05f702db255ba66b029482d0d0d07c3
SHA256

699abbdd10a3b0d9e8f85c53dab0dababf8e0025cd3567387a3dc3a523cd95dc
SHA512

12b826148675beb533d2e820239c7421eb2d7740d4978d59cbc457d35acdb75756624dc4c6bbb2c37cc1e5c112a9e1ca7aec8121f63ce76b2aa788802dcf5e7f
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXW:7wqd87VW

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1960-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1960	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1960	1688	rundll32.exe	30
PID 1688 wrote to memory of 1960	1688	rundll32.exe	30
PID 1688 wrote to memory of 1960	1688	rundll32.exe	30
PID 1688 wrote to memory of 1960	1688	rundll32.exe	30
PID 1688 wrote to memory of 1960	1688	rundll32.exe	30
PID 1688 wrote to memory of 1960	1688	rundll32.exe	30
PID 1688 wrote to memory of 1960	1688	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\699abbdd10a3b0d9e8f85c53dab0dababf8e0025cd3567387a3dc3a523cd95dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\699abbdd10a3b0d9e8f85c53dab0dababf8e0025cd3567387a3dc3a523cd95dc.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1960

memory/1960-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download