gh0strat | 30985dd08b83bffe1f4a0d668939740b3ac3073dfc4d08135a01ec8c27f7a56f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 07:51

Target

66b9fab919d35e12abde49315371145d_JaffaCakes118.dll
Size

86KB
MD5

66b9fab919d35e12abde49315371145d
SHA1

21febacb118389e32b3dcc8fe6316b2d47e4f628
SHA256

30985dd08b83bffe1f4a0d668939740b3ac3073dfc4d08135a01ec8c27f7a56f
SHA512

b4958626d376b1fb092a0e2d26f2750f7fd9e4f1490b6beb77ade24946ae33480c73c6899c7a593a46d7068569efd8f04d549db2bf4966a0ea6810c0cb30961b
SSDEEP

1536:DZx6TxcmiWTCnmxLON3iU+c6DIfTBqY/lXTi+a1+:DZx6Tx3mnmxLCiU+BDyTBqMhTi+ao

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1408-0-0x0000000010000000-0x0000000010018000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 1408	3816	rundll32.exe	84
PID 3816 wrote to memory of 1408	3816	rundll32.exe	84
PID 3816 wrote to memory of 1408	3816	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\66b9fab919d35e12abde49315371145d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\66b9fab919d35e12abde49315371145d_JaffaCakes118.dll,#1
  2⤵
  PID:1408

memory/1408-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download