Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:24
Behavioral task
behavioral1
Sample
2dbf315ec7bf0c735f333c2e7fde0f2fee05bc2b5c02ea16c3699e02a92e88f0.dll
Resource
win7-20240215-en
4 signatures
150 seconds
General
-
Target
2dbf315ec7bf0c735f333c2e7fde0f2fee05bc2b5c02ea16c3699e02a92e88f0.dll
-
Size
899KB
-
MD5
467721243b62732270c0990a85c185e2
-
SHA1
2c71ba0338d6bddb869d13d1c107f750726dcacc
-
SHA256
2dbf315ec7bf0c735f333c2e7fde0f2fee05bc2b5c02ea16c3699e02a92e88f0
-
SHA512
0d24ca8206e74959990baff538dc84bb0df172d45477db2a3b5bf69a0d55cdbb5268f34c3c32b68ae698e113d54f1d163ad21808d958321713ccf4586f09f42e
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXM:7wqd87VM
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2832-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 2832 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3864 wrote to memory of 2832 3864 rundll32.exe rundll32.exe PID 3864 wrote to memory of 2832 3864 rundll32.exe rundll32.exe PID 3864 wrote to memory of 2832 3864 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2dbf315ec7bf0c735f333c2e7fde0f2fee05bc2b5c02ea16c3699e02a92e88f0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2dbf315ec7bf0c735f333c2e7fde0f2fee05bc2b5c02ea16c3699e02a92e88f0.dll,#12⤵
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2832-0-0x0000000010000000-0x000000001014F000-memory.dmpFilesize
1.3MB