Analysis
-
max time kernel
149s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 12:20
Behavioral task
behavioral1
Sample
64f64cb08661545b7ffc486a6f51260b421a3f46fbe9c99724d2c1d122bd251c.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
64f64cb08661545b7ffc486a6f51260b421a3f46fbe9c99724d2c1d122bd251c.dll
-
Size
899KB
-
MD5
c653842cc0f83b5ad78f4c33ee4e0262
-
SHA1
c6c88a42d435b1df4fc096d9bbe6787a67f823ed
-
SHA256
64f64cb08661545b7ffc486a6f51260b421a3f46fbe9c99724d2c1d122bd251c
-
SHA512
c8c6b2635e14454b5beb38a8aaf9145d62342230719252f2abdcd2fbca6cf6dbe40b85440fbaade0421a46ed08b6326658f0ccaea657a8526fc4e1d8d409ef75
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXv:7wqd87Vv
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4868-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4868 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3148 wrote to memory of 4868 3148 rundll32.exe 85 PID 3148 wrote to memory of 4868 3148 rundll32.exe 85 PID 3148 wrote to memory of 4868 3148 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\64f64cb08661545b7ffc486a6f51260b421a3f46fbe9c99724d2c1d122bd251c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\64f64cb08661545b7ffc486a6f51260b421a3f46fbe9c99724d2c1d122bd251c.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4868
-