gh0strat | 60c7fb5998342c3dfa0eec07116116f92b1c486e772e224e254eb19401863707

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 05:05

Target

60c7fb5998342c3dfa0eec07116116f92b1c486e772e224e254eb19401863707.dll
Size

50KB
MD5

50a6424d70e18fa26c275d744f79d015
SHA1

1a3fe19740b6d0a17f333ef606ab0d295c0bee6c
SHA256

60c7fb5998342c3dfa0eec07116116f92b1c486e772e224e254eb19401863707
SHA512

b7edd519ded5c4bd7d2b7d0cd2e6dd5a373b9cdc9fc20ae8ed188da1f33cee7cd1b75feeb4acc7742b5f8bb58d57b343b8e4c8f76163bbdf4bda2c538abae863
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5/JYH:W5ReWjTrW9rNPgYopJYH

Score

10^/10

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4436-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

4436 rundll32.exe

resource	yara_rule
behavioral2/memory/4436-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

pid	process
4436	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3764 wrote to memory of 4436	3764	rundll32.exe	rundll32.exe
PID 3764 wrote to memory of 4436	3764	rundll32.exe	rundll32.exe
PID 3764 wrote to memory of 4436	3764	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60c7fb5998342c3dfa0eec07116116f92b1c486e772e224e254eb19401863707.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3764

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\60c7fb5998342c3dfa0eec07116116f92b1c486e772e224e254eb19401863707.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:4436

memory/4436-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download