Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 05:19
Behavioral task
behavioral1
Sample
271d3375884856fbedb7955d69588633da2b8f51794e3512182a4fcbeaca28ee.dll
Resource
win7-20240220-en
4 signatures
150 seconds
General
-
Target
271d3375884856fbedb7955d69588633da2b8f51794e3512182a4fcbeaca28ee.dll
-
Size
51KB
-
MD5
7bf0a2132375164cd9ee61e73b364d0a
-
SHA1
a50dcc453fb79a0db430f7d01702cf7791bde70e
-
SHA256
271d3375884856fbedb7955d69588633da2b8f51794e3512182a4fcbeaca28ee
-
SHA512
052e2b085bf3a598160ad9b383f5d3b77b3264f8f2ada7a3f177b2986b42f100c52a13c2bf8b3e5bbb04178c7b6c50eae71f905860f05aa285d54a7d4d86b598
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLvJYH5:1dWubF3n9S91BF3fboLJYH5
Malware Config
Extracted
Family
gh0strat
C2
kinh.xmcxmr.com
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2820-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2820 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2064 wrote to memory of 2820 2064 rundll32.exe 28 PID 2064 wrote to memory of 2820 2064 rundll32.exe 28 PID 2064 wrote to memory of 2820 2064 rundll32.exe 28 PID 2064 wrote to memory of 2820 2064 rundll32.exe 28 PID 2064 wrote to memory of 2820 2064 rundll32.exe 28 PID 2064 wrote to memory of 2820 2064 rundll32.exe 28 PID 2064 wrote to memory of 2820 2064 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\271d3375884856fbedb7955d69588633da2b8f51794e3512182a4fcbeaca28ee.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\271d3375884856fbedb7955d69588633da2b8f51794e3512182a4fcbeaca28ee.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2820
-