Analysis
-
max time kernel
148s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 00:18
Behavioral task
behavioral1
Sample
6081e9627c56e5532535b81ce4f6a626c6da34c614f7b9f7ba02deb4ab24ba19.dll
Resource
win7-20231129-en
4 signatures
150 seconds
General
-
Target
6081e9627c56e5532535b81ce4f6a626c6da34c614f7b9f7ba02deb4ab24ba19.dll
-
Size
899KB
-
MD5
396468c5590066d3e47897f0bd7df358
-
SHA1
2aafef4c42122997b31d5ae8db137bbe34d175f8
-
SHA256
6081e9627c56e5532535b81ce4f6a626c6da34c614f7b9f7ba02deb4ab24ba19
-
SHA512
953db5cc0e338b46d36de72bbcef95ac83b172103583238d9e057593725365adaac5d5ae86e3f8b94fe8c375c872306d422612ff49ff6f99e4a2722397a1e2a7
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXl:7wqd87Vl
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/1436-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1436 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2748 wrote to memory of 1436 2748 rundll32.exe 83 PID 2748 wrote to memory of 1436 2748 rundll32.exe 83 PID 2748 wrote to memory of 1436 2748 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6081e9627c56e5532535b81ce4f6a626c6da34c614f7b9f7ba02deb4ab24ba19.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6081e9627c56e5532535b81ce4f6a626c6da34c614f7b9f7ba02deb4ab24ba19.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:1436
-