Analysis
-
max time kernel
146s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 00:17
Behavioral task
behavioral1
Sample
c3a4847872ec9932cf4513740bd392255ca3587195b8e51cfb1f064e0dfeff8f.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
c3a4847872ec9932cf4513740bd392255ca3587195b8e51cfb1f064e0dfeff8f.dll
-
Size
899KB
-
MD5
f7c8dabd63906184bd9abee20cc3c916
-
SHA1
12aca76c604cff81ae6df2e2b582c83e7ad84a30
-
SHA256
c3a4847872ec9932cf4513740bd392255ca3587195b8e51cfb1f064e0dfeff8f
-
SHA512
0ac50247f8ef0de12feb84810b969d1fee0980bff611e63a2f207aed23d6d300f3731bdaebd7ce5c1a35749e53927dcdcb23a5d339fa804e295c273978c90098
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXu:7wqd87Vu
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/3688-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3688 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2616 wrote to memory of 3688 2616 rundll32.exe 82 PID 2616 wrote to memory of 3688 2616 rundll32.exe 82 PID 2616 wrote to memory of 3688 2616 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c3a4847872ec9932cf4513740bd392255ca3587195b8e51cfb1f064e0dfeff8f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c3a4847872ec9932cf4513740bd392255ca3587195b8e51cfb1f064e0dfeff8f.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:3688
-