Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/04/2024, 09:14
Behavioral task
behavioral1
Sample
ebec875b3a29e3636b42412854766caf7ac312d1bd2eb9d14a38dbfc806d7ef4.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
ebec875b3a29e3636b42412854766caf7ac312d1bd2eb9d14a38dbfc806d7ef4.dll
-
Size
51KB
-
MD5
107b43b31e9796e042ad3ffb06bedf42
-
SHA1
3e63164a6d65b64180e3fceea0656c9ec858e891
-
SHA256
ebec875b3a29e3636b42412854766caf7ac312d1bd2eb9d14a38dbfc806d7ef4
-
SHA512
69a4571c264cb482c03b7f3f4f36499bdd4f12ecbfa5c30935c21caf72458c2f400db4e09fcaadc2a6ef452d9da7fc934abe60a1bbf2e284f6c02cf8e544de17
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLiJYH5:1dWubF3n9S91BF3fbo+JYH5
Malware Config
Extracted
Family
gh0strat
C2
kinh.xmcxmr.com
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2836-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2836 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2836 2336 rundll32.exe 28 PID 2336 wrote to memory of 2836 2336 rundll32.exe 28 PID 2336 wrote to memory of 2836 2336 rundll32.exe 28 PID 2336 wrote to memory of 2836 2336 rundll32.exe 28 PID 2336 wrote to memory of 2836 2336 rundll32.exe 28 PID 2336 wrote to memory of 2836 2336 rundll32.exe 28 PID 2336 wrote to memory of 2836 2336 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ebec875b3a29e3636b42412854766caf7ac312d1bd2eb9d14a38dbfc806d7ef4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ebec875b3a29e3636b42412854766caf7ac312d1bd2eb9d14a38dbfc806d7ef4.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2836
-