gh0strat | 643584b8d2baa92b7aac3f97aca9a9f52bb7c211b4db77c17c11f2540ae9d335

Analysis

max time kernel
141s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 22:55

Target

643584b8d2baa92b7aac3f97aca9a9f52bb7c211b4db77c17c11f2540ae9d335.dll
Size

50KB
MD5

db3d5b89a6769f5af34f839a8eef2e78
SHA1

09317da75eab700e1fa6c779d9d16eedfe37b6dc
SHA256

643584b8d2baa92b7aac3f97aca9a9f52bb7c211b4db77c17c11f2540ae9d335
SHA512

7917c6e54453fa77e9137d2517f4f1c10ce0058cc0f4e3ff0db4f99c70f589765a9d4873f3c40e3472f0e49b0df3d0588c50472e510988a9209e720e261f01c5
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5WJYH:W5ReWjTrW9rNPgYowJYH

Score

10^/10

gh0strat rat

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1492-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1492	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1492	4600	rundll32.exe	84
PID 4600 wrote to memory of 1492	4600	rundll32.exe	84
PID 4600 wrote to memory of 1492	4600	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\643584b8d2baa92b7aac3f97aca9a9f52bb7c211b4db77c17c11f2540ae9d335.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\643584b8d2baa92b7aac3f97aca9a9f52bb7c211b4db77c17c11f2540ae9d335.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1492

memory/1492-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download