gh0strat | 264fa6c76d94408c366560bbdfde9fd34f4f237797fc551fd73764b6887d9a9a

Analysis

max time kernel
140s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 09:44

Target

264fa6c76d94408c366560bbdfde9fd34f4f237797fc551fd73764b6887d9a9a.dll
Size

51KB
MD5

6dfbe3de3f2242dd2bbdf5f09ba21570
SHA1

b83f031222c1c8f3998bf81824c274bb1a29cc99
SHA256

264fa6c76d94408c366560bbdfde9fd34f4f237797fc551fd73764b6887d9a9a
SHA512

491b5ba6a902afadcd040ed63d64fed3ba9e824225af3caab38ca12c1bb2fd5cff9485b66b197256d99cb73931a45e745aa7d5ea4bc1c7c73a1311c4cea40f3a
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLMJYH5:1dWubF3n9S91BF3fbogJYH5

Score

10^/10

gh0strat rat

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/2364-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2364	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2364	1140	rundll32.exe	30
PID 1140 wrote to memory of 2364	1140	rundll32.exe	30
PID 1140 wrote to memory of 2364	1140	rundll32.exe	30
PID 1140 wrote to memory of 2364	1140	rundll32.exe	30
PID 1140 wrote to memory of 2364	1140	rundll32.exe	30
PID 1140 wrote to memory of 2364	1140	rundll32.exe	30
PID 1140 wrote to memory of 2364	1140	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\264fa6c76d94408c366560bbdfde9fd34f4f237797fc551fd73764b6887d9a9a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\264fa6c76d94408c366560bbdfde9fd34f4f237797fc551fd73764b6887d9a9a.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2364

memory/2364-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download