Analysis
-
max time kernel
144s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 12:23
Behavioral task
behavioral1
Sample
de20849b83edc30ba1b744cf6d40928e60b0a29fba1b98bcb7756396798971ca.dll
Resource
win7-20240419-en
4 signatures
150 seconds
General
-
Target
de20849b83edc30ba1b744cf6d40928e60b0a29fba1b98bcb7756396798971ca.dll
-
Size
899KB
-
MD5
e96328b7a0da2b2bac94a65200a1b379
-
SHA1
f366489a9b8e1caeec14de3149a6b35777e9b555
-
SHA256
de20849b83edc30ba1b744cf6d40928e60b0a29fba1b98bcb7756396798971ca
-
SHA512
db6958d65abe910f0e1fa243ee4f1e5ebb48d55c3718c5ea2bdf0c281e2f187174050d93fb5794cdcf754294aacb9f5f4db5cfca5bb822caf32feeafc7c500d9
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXw:7wqd87Vw
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4700-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4700 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 324 wrote to memory of 4700 324 rundll32.exe 83 PID 324 wrote to memory of 4700 324 rundll32.exe 83 PID 324 wrote to memory of 4700 324 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\de20849b83edc30ba1b744cf6d40928e60b0a29fba1b98bcb7756396798971ca.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\de20849b83edc30ba1b744cf6d40928e60b0a29fba1b98bcb7756396798971ca.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4700
-