Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 14:09
Behavioral task
behavioral1
Sample
76288199d4645cdc3e7cdd4cf5e5c331f757e04fa2d3c57172fcc8e2ec078cf2.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
76288199d4645cdc3e7cdd4cf5e5c331f757e04fa2d3c57172fcc8e2ec078cf2.dll
-
Size
899KB
-
MD5
3f02b6c0cadc4c14c2b8d8c2461415e3
-
SHA1
c3dd019a87bbe60be1b8a843bcea2427f2c7557c
-
SHA256
76288199d4645cdc3e7cdd4cf5e5c331f757e04fa2d3c57172fcc8e2ec078cf2
-
SHA512
9cb0176c9fed99db68351f8f78adf7721314311512bd3c184b6cb8b7f00f5ad7ceaf5d542a7649710d527e25ce7f69136b3a031a7e7d57f99d4b92e9d648b3b4
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXD:7wqd87VD
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/1096-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1096 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2512 wrote to memory of 1096 2512 rundll32.exe 28 PID 2512 wrote to memory of 1096 2512 rundll32.exe 28 PID 2512 wrote to memory of 1096 2512 rundll32.exe 28 PID 2512 wrote to memory of 1096 2512 rundll32.exe 28 PID 2512 wrote to memory of 1096 2512 rundll32.exe 28 PID 2512 wrote to memory of 1096 2512 rundll32.exe 28 PID 2512 wrote to memory of 1096 2512 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\76288199d4645cdc3e7cdd4cf5e5c331f757e04fa2d3c57172fcc8e2ec078cf2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\76288199d4645cdc3e7cdd4cf5e5c331f757e04fa2d3c57172fcc8e2ec078cf2.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:1096
-