gh0strat | be009674b11c99ae1a2bfcc7ab98587743e5d44054e327e2f1361489a73025af

Analysis

max time kernel
142s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:22

Target

be009674b11c99ae1a2bfcc7ab98587743e5d44054e327e2f1361489a73025af.dll
Size

899KB
MD5

17934356eb21b49c4c66473a50341742
SHA1

18b641939654c2edfcd805b6db458f675bd21cda
SHA256

be009674b11c99ae1a2bfcc7ab98587743e5d44054e327e2f1361489a73025af
SHA512

4a4372e4fa259702072acc60262fdb7b40ad7182ea4b4f2788fbcd0f6912bdc206d15dabc851969322b360e58c640e1459d78131cca476ffcfa2d0e2a76cdf38
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXb:7wqd87Vb

Score

10^/10

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4564-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

4564 rundll32.exe

resource	yara_rule
behavioral2/memory/4564-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

pid	process
4564	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 644 wrote to memory of 4564	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 4564	644	rundll32.exe	rundll32.exe
PID 644 wrote to memory of 4564	644	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be009674b11c99ae1a2bfcc7ab98587743e5d44054e327e2f1361489a73025af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be009674b11c99ae1a2bfcc7ab98587743e5d44054e327e2f1361489a73025af.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:4564

memory/4564-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download