Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 21:58
Behavioral task
behavioral1
Sample
d087ba7be24bbdd35f3aa128059ea1dd3ddd6cc5376d4b9e2dfcea452deda94a.dll
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
-
Target
d087ba7be24bbdd35f3aa128059ea1dd3ddd6cc5376d4b9e2dfcea452deda94a.dll
-
Size
701KB
-
MD5
e1517af819f7d352b8daeed94f5b7450
-
SHA1
feac89d0ece8e253b5ee519479d138e5992d036d
-
SHA256
d087ba7be24bbdd35f3aa128059ea1dd3ddd6cc5376d4b9e2dfcea452deda94a
-
SHA512
0c5d42d0acc99468064b749c07c1e6422e238df0db35c9c12e8a57680c55c70b18eb437fd6b6aa7d78cfc5c3b43617d9e6e54215733a99e2fba6c216c8699f0e
-
SSDEEP
12288:7gIn6s/NFLEs3IOcwKs/rs9aaVBTlm64fPtA+AfbOIEH/WRep8KKJv3Tf:7dJjIOcwKs/r8lm6L+vz/eepPy
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/384-133-0x00000000026B0000-0x0000000002856000-memory.dmp purplefox_rootkit behavioral2/memory/384-139-0x0000000010000000-0x0000000010169000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/384-133-0x00000000026B0000-0x0000000002856000-memory.dmp family_gh0strat behavioral2/memory/384-139-0x0000000010000000-0x0000000010169000-memory.dmp family_gh0strat -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 5 384 rundll32.exe 45 384 rundll32.exe -
Processes:
resource yara_rule behavioral2/memory/384-139-0x0000000010000000-0x0000000010169000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Éù¿¨Çý¶¯ = "C:\\Windows\\SysWOW64\\rundll32.exe" rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3564 wrote to memory of 384 3564 rundll32.exe rundll32.exe PID 3564 wrote to memory of 384 3564 rundll32.exe rundll32.exe PID 3564 wrote to memory of 384 3564 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d087ba7be24bbdd35f3aa128059ea1dd3ddd6cc5376d4b9e2dfcea452deda94a.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d087ba7be24bbdd35f3aa128059ea1dd3ddd6cc5376d4b9e2dfcea452deda94a.dll,#12⤵
- Blocklisted process makes network request
- Adds Run key to start application