gh0strat | 9e364ccf2384a19973de23c0b730e50a84a250f915e09253e77740baa69eb9bb | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 09:20

Sharing

Report Analysis Logs

General

Target

Bin1799/Plugins/ShellCode.bat
Size

569B
MD5

8cd7ab4e93011f62c0ffb49550f953d2
SHA1

70aac31a1a5be483ec1a7909b5f50efaeee27bc1
SHA256

81e626258fdd763b3e2aa53d98070d7cbcba2e5ed80e0eb535d9707d8c9f7083
SHA512

90a458dafd2aa61dd3ab1ba9f6a0f653c52f5190755f17eebee70d5dec44081d417f1a32e35fb0ddae42afb7808da906b2dfdc0f84d89b90dbe477310dd08d86

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Bin1799\Plugins\2.dll	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

ShellCode.exe

pid process

2728 ShellCode.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2676 wrote to memory of 2728	2676	cmd.exe	ShellCode.exe
PID 2676 wrote to memory of 2728	2676	cmd.exe	ShellCode.exe
PID 2676 wrote to memory of 2728	2676	cmd.exe	ShellCode.exe
PID 2676 wrote to memory of 2728	2676	cmd.exe	ShellCode.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Bin1799\Plugins\ShellCode.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Local\Temp\Bin1799\Plugins\ShellCode.exe
  ShellCode.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Bin1799\Plugins\2.dll

Filesize
500KB

MD5
47b1c650018609f277dd9ef884bfe1fb

SHA1
16980e8384918f5eeb61e53be2d769bbd59a126e

SHA256
d3d8efeb396807430ffcd22281866126951a0542e921dd8d2da67fdf61634e33

SHA512
085a15f793543d814842e0aa81e0d7b983a6e3b7c370489fdd44bbde4dd07b09a93757686673f2d6cac3df2cccaf77b5c5b4b725774ad437de7d0476f6a9d9d9

Download Submit