Analysis
-
max time kernel
145s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 09:14
Behavioral task
behavioral1
Sample
ebec875b3a29e3636b42412854766caf7ac312d1bd2eb9d14a38dbfc806d7ef4.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
ebec875b3a29e3636b42412854766caf7ac312d1bd2eb9d14a38dbfc806d7ef4.dll
-
Size
51KB
-
MD5
107b43b31e9796e042ad3ffb06bedf42
-
SHA1
3e63164a6d65b64180e3fceea0656c9ec858e891
-
SHA256
ebec875b3a29e3636b42412854766caf7ac312d1bd2eb9d14a38dbfc806d7ef4
-
SHA512
69a4571c264cb482c03b7f3f4f36499bdd4f12ecbfa5c30935c21caf72458c2f400db4e09fcaadc2a6ef452d9da7fc934abe60a1bbf2e284f6c02cf8e544de17
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLiJYH5:1dWubF3n9S91BF3fbo+JYH5
Malware Config
Extracted
Family
gh0strat
C2
kinh.xmcxmr.com
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4284-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4284 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3488 wrote to memory of 4284 3488 rundll32.exe 83 PID 3488 wrote to memory of 4284 3488 rundll32.exe 83 PID 3488 wrote to memory of 4284 3488 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ebec875b3a29e3636b42412854766caf7ac312d1bd2eb9d14a38dbfc806d7ef4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ebec875b3a29e3636b42412854766caf7ac312d1bd2eb9d14a38dbfc806d7ef4.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4284
-