gh0strat | 1715305202af4fe691c0fede48ca69c6516c88d9e92c6bae6116ea3a8da6b3c9

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 22:22

Target

1715305202af4fe691c0fede48ca69c6516c88d9e92c6bae6116ea3a8da6b3c9.dll
Size

51KB
MD5

1d0e3fc03382fe0f0d4bbe16e2305bd0
SHA1

2eec72306c556497f83001775ac2d2233fd51dcb
SHA256

1715305202af4fe691c0fede48ca69c6516c88d9e92c6bae6116ea3a8da6b3c9
SHA512

95798276fa49406c14e91dfb3769bcf5633fe1fe512d8a5ef2e66461ccf632b27435ae9a9fc0f54220ff2283656431c5757eb67b5a1c7740292496c088f037e1
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLZJYH5:1dWubF3n9S91BF3fbodJYH5

Score

10^/10

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/812-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

812 rundll32.exe

resource	yara_rule
behavioral2/memory/812-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

pid	process
812	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3936 wrote to memory of 812	3936	rundll32.exe	rundll32.exe
PID 3936 wrote to memory of 812	3936	rundll32.exe	rundll32.exe
PID 3936 wrote to memory of 812	3936	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1715305202af4fe691c0fede48ca69c6516c88d9e92c6bae6116ea3a8da6b3c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1715305202af4fe691c0fede48ca69c6516c88d9e92c6bae6116ea3a8da6b3c9.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:4508

memory/812-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download