gh0strat | ddec4741cc1f9ae5a88cd6d3a94536cb74cd438351eef53be49e9396cf63d1c2

Analysis

max time kernel
140s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 05:08

Target

ddec4741cc1f9ae5a88cd6d3a94536cb74cd438351eef53be49e9396cf63d1c2.dll
Size

51KB
MD5

68623d1dc46f5282640531cdead54b8c
SHA1

48cceecf659addb8abac6f4dfb6d35dce4834c59
SHA256

ddec4741cc1f9ae5a88cd6d3a94536cb74cd438351eef53be49e9396cf63d1c2
SHA512

e2b20a1dd3a877e44238338d333266b9c855be33d3460c3a46148585784da849fe5abd5c7fa316bebdc33a9aeb42eef7281e3e60ba00ba9f43352a3e85038eef
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLrJYH5:1dWubF3n9S91BF3fbo3JYH5

Score

10^/10

Family

gh0strat

kinh.xmcxmr.com

Gh0st RAT payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2988-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Suspicious behavior: RenamesItself 1 IoCs

Processes:

rundll32.exe

pid process

2988 rundll32.exe

resource	yara_rule
behavioral1/memory/2988-0-0x0000000010000000-0x0000000010011000-memory.dmp	family_gh0strat

pid	process
2988	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2460 wrote to memory of 2988	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 2988	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 2988	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 2988	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 2988	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 2988	2460	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 2988	2460	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddec4741cc1f9ae5a88cd6d3a94536cb74cd438351eef53be49e9396cf63d1c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddec4741cc1f9ae5a88cd6d3a94536cb74cd438351eef53be49e9396cf63d1c2.dll,#1
2⤵
- Suspicious behavior: RenamesItself
PID:2988

memory/2988-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download