gh0strat | 5c17b97d791db3705261f3f7ad56ddf6c511d9c658e7d9891688cfac0e36de66

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 05:09

Target

5c17b97d791db3705261f3f7ad56ddf6c511d9c658e7d9891688cfac0e36de66.dll
Size

50KB
MD5

60c692c8b37e6abed62f3205e5b3ed33
SHA1

0f3a2572633ec6de8d00fd7880c374eda9ea6272
SHA256

5c17b97d791db3705261f3f7ad56ddf6c511d9c658e7d9891688cfac0e36de66
SHA512

f8ba43ae01a7ae94a02824190067759a5f5339176e80a7f36939dbd14d50e5bb2e46fe59e1c78830e0358b6b44b625a09687d927f9d62a9158f45b0c46c96044
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5cJYH:W5ReWjTrW9rNPgYo+JYH

Score

10^/10

Family

gh0strat

hackerinvasion.f3322.net

Gh0st RAT payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4320-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

4320 rundll32.exe

resource	yara_rule
behavioral2/memory/4320-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

pid	process
4320	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3024 wrote to memory of 4320	3024	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 4320	3024	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 4320	3024	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c17b97d791db3705261f3f7ad56ddf6c511d9c658e7d9891688cfac0e36de66.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5c17b97d791db3705261f3f7ad56ddf6c511d9c658e7d9891688cfac0e36de66.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:4320

memory/4320-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download