Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 00:18
Behavioral task
behavioral1
Sample
f2ec8e00a71d505d0f580b77c929af028d8075418e2b25721abe9905898ec3e9.dll
Resource
win7-20240220-en
4 signatures
150 seconds
General
-
Target
f2ec8e00a71d505d0f580b77c929af028d8075418e2b25721abe9905898ec3e9.dll
-
Size
51KB
-
MD5
dcc7fe9984f40191ebdc192d1b2055f4
-
SHA1
a95740d181ad427f5125a45f3a86de35d5fc4597
-
SHA256
f2ec8e00a71d505d0f580b77c929af028d8075418e2b25721abe9905898ec3e9
-
SHA512
730717bf8d378d1dc0d52513f1ff9055f251661ced653045ff5082d7c16d3c3c5b7d0f561da9ea619ab549000f0d7f5c8618ab5ef8078be4ce5c913010169bfd
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLNJYH5:1dWubF3n9S91BF3fbohJYH5
Malware Config
Extracted
Family
gh0strat
C2
kinh.xmcxmr.com
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/1788-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1788 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2960 wrote to memory of 1788 2960 rundll32.exe 28 PID 2960 wrote to memory of 1788 2960 rundll32.exe 28 PID 2960 wrote to memory of 1788 2960 rundll32.exe 28 PID 2960 wrote to memory of 1788 2960 rundll32.exe 28 PID 2960 wrote to memory of 1788 2960 rundll32.exe 28 PID 2960 wrote to memory of 1788 2960 rundll32.exe 28 PID 2960 wrote to memory of 1788 2960 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f2ec8e00a71d505d0f580b77c929af028d8075418e2b25721abe9905898ec3e9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f2ec8e00a71d505d0f580b77c929af028d8075418e2b25721abe9905898ec3e9.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:1788
-