Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 03:18
Behavioral task
behavioral1
Sample
3d762c0dc9c68d4b55a94ed1b45178e746c72cb60b91cfef4288aedbc0f2f989.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
3d762c0dc9c68d4b55a94ed1b45178e746c72cb60b91cfef4288aedbc0f2f989.dll
-
Size
899KB
-
MD5
a5df1dda5f649f915c10956542ce8d34
-
SHA1
a8590b26c8db24d78a6cafdbeeb5222f62378479
-
SHA256
3d762c0dc9c68d4b55a94ed1b45178e746c72cb60b91cfef4288aedbc0f2f989
-
SHA512
ce3cbf4f91733bb1078b3dc0a13229761df27e1b6cb7f26f18d708486d8b1ca10a2f4540084d11c6c285cc84794757c7db9db69e796ed9313a7e5647d979e3aa
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXr:7wqd87Vr
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2860-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2860 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2860 2156 rundll32.exe 28 PID 2156 wrote to memory of 2860 2156 rundll32.exe 28 PID 2156 wrote to memory of 2860 2156 rundll32.exe 28 PID 2156 wrote to memory of 2860 2156 rundll32.exe 28 PID 2156 wrote to memory of 2860 2156 rundll32.exe 28 PID 2156 wrote to memory of 2860 2156 rundll32.exe 28 PID 2156 wrote to memory of 2860 2156 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3d762c0dc9c68d4b55a94ed1b45178e746c72cb60b91cfef4288aedbc0f2f989.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3d762c0dc9c68d4b55a94ed1b45178e746c72cb60b91cfef4288aedbc0f2f989.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2860
-