Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 18:31
Behavioral task
behavioral1
Sample
a21b7b3407ecdb33a3e2d5de26429529dd26c40d924bb915ea89c6f43cf9e626.dll
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
General
-
Target
a21b7b3407ecdb33a3e2d5de26429529dd26c40d924bb915ea89c6f43cf9e626.dll
-
Size
51KB
-
MD5
b5efc3993871f34cce117948a0f584aa
-
SHA1
20b826514f3683459d7d0df12edbaf4a1e2b5a4b
-
SHA256
a21b7b3407ecdb33a3e2d5de26429529dd26c40d924bb915ea89c6f43cf9e626
-
SHA512
dbf1c186c2bfa049ca7e82ebe3b27990cf983369d2d823cfe955c362b6b69d761fb6f5f79aef57831fe855c5e94738e76c2d5fc2f07f12dd932c90bea5586caa
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+qJYH5:1dWubF3n9S91BF3fboFJYH5
Malware Config
Extracted
Family
gh0strat
C2
kinh.xmcxmr.com
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2092-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 2092 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4900 wrote to memory of 2092 4900 rundll32.exe rundll32.exe PID 4900 wrote to memory of 2092 4900 rundll32.exe rundll32.exe PID 4900 wrote to memory of 2092 4900 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a21b7b3407ecdb33a3e2d5de26429529dd26c40d924bb915ea89c6f43cf9e626.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a21b7b3407ecdb33a3e2d5de26429529dd26c40d924bb915ea89c6f43cf9e626.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2092
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2092-0-0x0000000010000000-0x0000000010011000-memory.dmpFilesize
68KB