Analysis
-
max time kernel
147s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 12:15
Behavioral task
behavioral1
Sample
d45dd50ced1ea4fd8a8deaf3a6a8bd8365f9e779ba2da3b475f92b698d59d158.dll
Resource
win7-20240220-en
4 signatures
150 seconds
General
-
Target
d45dd50ced1ea4fd8a8deaf3a6a8bd8365f9e779ba2da3b475f92b698d59d158.dll
-
Size
899KB
-
MD5
3dc6dcaabf29114fd14034a5b5ed6893
-
SHA1
96673a486ebf636a94e01c45d7cd280b561c079e
-
SHA256
d45dd50ced1ea4fd8a8deaf3a6a8bd8365f9e779ba2da3b475f92b698d59d158
-
SHA512
74f0a98fb568f97796927b307ac5251d0e56720b0a7e32583abe2c5499e2c4b3fd411654f86777d411656e2532e75e4afaa48ec9f625c1366c39a218262356c3
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXS:7wqd87VS
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4376-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4376 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4652 wrote to memory of 4376 4652 rundll32.exe 85 PID 4652 wrote to memory of 4376 4652 rundll32.exe 85 PID 4652 wrote to memory of 4376 4652 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d45dd50ced1ea4fd8a8deaf3a6a8bd8365f9e779ba2da3b475f92b698d59d158.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d45dd50ced1ea4fd8a8deaf3a6a8bd8365f9e779ba2da3b475f92b698d59d158.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4376
-