gh0strat | 1b26bad6f2f89f4dd63267a54acde9f470d1acc72efb6235c638aaa62a50b122

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 03:09

Target

1b26bad6f2f89f4dd63267a54acde9f470d1acc72efb6235c638aaa62a50b122.dll
Size

899KB
MD5

f7a75721f7996a0aa038f66705213a5e
SHA1

2419219483066173e924c5414df87e0a09e73b13
SHA256

1b26bad6f2f89f4dd63267a54acde9f470d1acc72efb6235c638aaa62a50b122
SHA512

baa7864a1a38efa0196d1a987b27e95b8e342e2d96e7cf3a001e8715a990098b9c08deb5ac6fde5e7084fcb5852ff06d1ef7ea60e2239e2861f47eb1ba0973f3
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX5:7wqd87V5

Score

10^/10

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/2772-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2772 rundll32.exe

resource	yara_rule
behavioral2/memory/2772-0-0x0000000010000000-0x000000001014F000-memory.dmp	family_gh0strat

pid	process
2772	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3248 wrote to memory of 2772	3248	rundll32.exe	rundll32.exe
PID 3248 wrote to memory of 2772	3248	rundll32.exe	rundll32.exe
PID 3248 wrote to memory of 2772	3248	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b26bad6f2f89f4dd63267a54acde9f470d1acc72efb6235c638aaa62a50b122.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3248

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b26bad6f2f89f4dd63267a54acde9f470d1acc72efb6235c638aaa62a50b122.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2772

memory/2772-0-0x0000000010000000-0x000000001014F000-memory.dmp

Filesize
1.3MB

Download