Analysis
-
max time kernel
134s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:22
Behavioral task
behavioral1
Sample
6138e41d3dc18f77e6c7142cf3167ca711b60866a7f2fb4f2ba47c6d593dface.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
6138e41d3dc18f77e6c7142cf3167ca711b60866a7f2fb4f2ba47c6d593dface.dll
-
Size
167KB
-
MD5
1002c423de040422f2ddedac961950ec
-
SHA1
af93087d4ee6af9ddf84731413f197e9f38c580e
-
SHA256
6138e41d3dc18f77e6c7142cf3167ca711b60866a7f2fb4f2ba47c6d593dface
-
SHA512
e6cd8c01157d4cf8af934050c94309e273d9f3dac26af9f4bdb0fee480d58fda8860ee2bc5d9499b50e623e53cd4efba91a3ec30ad76c9236a8294f7f1fcc0bf
-
SSDEEP
3072:LUDBHy4BBy6eFJrmmIewRxM6JSQTqGd4Pwc3q:L0yB6oJrcRZQcqGywq
Malware Config
Signatures
-
Gh0st RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/2216-6-0x0000000000400000-0x000000000040B000-memory.dmp family_gh0strat behavioral1/memory/2216-12-0x0000000000400000-0x000000000040B000-memory.dmp family_gh0strat behavioral1/memory/2216-11-0x0000000000400000-0x000000000040B000-memory.dmp family_gh0strat behavioral1/memory/2216-9-0x0000000000400000-0x000000000040B000-memory.dmp family_gh0strat behavioral1/memory/2216-13-0x0000000000400000-0x000000000040B000-memory.dmp family_gh0strat behavioral1/memory/2216-4-0x0000000000400000-0x000000000040B000-memory.dmp family_gh0strat behavioral1/memory/2216-14-0x0000000000400000-0x000000000040B000-memory.dmp family_gh0strat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 2168 set thread context of 2216 2168 rundll32.exe svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rundll32.exedescription pid process target process PID 2168 wrote to memory of 2216 2168 rundll32.exe svchost.exe PID 2168 wrote to memory of 2216 2168 rundll32.exe svchost.exe PID 2168 wrote to memory of 2216 2168 rundll32.exe svchost.exe PID 2168 wrote to memory of 2216 2168 rundll32.exe svchost.exe PID 2168 wrote to memory of 2216 2168 rundll32.exe svchost.exe PID 2168 wrote to memory of 2216 2168 rundll32.exe svchost.exe PID 2168 wrote to memory of 2216 2168 rundll32.exe svchost.exe PID 2168 wrote to memory of 2216 2168 rundll32.exe svchost.exe PID 2168 wrote to memory of 2216 2168 rundll32.exe svchost.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6138e41d3dc18f77e6c7142cf3167ca711b60866a7f2fb4f2ba47c6d593dface.dll,#11⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵PID:2216
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2216-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2216-12-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2216-11-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2216-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2216-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2216-13-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2216-4-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2216-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2216-2-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2216-14-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB