Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 14:09
Behavioral task
behavioral1
Sample
76288199d4645cdc3e7cdd4cf5e5c331f757e04fa2d3c57172fcc8e2ec078cf2.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
76288199d4645cdc3e7cdd4cf5e5c331f757e04fa2d3c57172fcc8e2ec078cf2.dll
-
Size
899KB
-
MD5
3f02b6c0cadc4c14c2b8d8c2461415e3
-
SHA1
c3dd019a87bbe60be1b8a843bcea2427f2c7557c
-
SHA256
76288199d4645cdc3e7cdd4cf5e5c331f757e04fa2d3c57172fcc8e2ec078cf2
-
SHA512
9cb0176c9fed99db68351f8f78adf7721314311512bd3c184b6cb8b7f00f5ad7ceaf5d542a7649710d527e25ce7f69136b3a031a7e7d57f99d4b92e9d648b3b4
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXD:7wqd87VD
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2660-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2660 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 312 wrote to memory of 2660 312 rundll32.exe 83 PID 312 wrote to memory of 2660 312 rundll32.exe 83 PID 312 wrote to memory of 2660 312 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\76288199d4645cdc3e7cdd4cf5e5c331f757e04fa2d3c57172fcc8e2ec078cf2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\76288199d4645cdc3e7cdd4cf5e5c331f757e04fa2d3c57172fcc8e2ec078cf2.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2660
-