Analysis
-
max time kernel
144s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 17:17
Behavioral task
behavioral1
Sample
fa166fc0fcb0dbb98bdeb60c340c54b1999d25180b392adad7141efeafe52b5b.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
fa166fc0fcb0dbb98bdeb60c340c54b1999d25180b392adad7141efeafe52b5b.dll
-
Size
51KB
-
MD5
dfa172a5a0cd1b2ad4be32308cb10477
-
SHA1
4a507d49bad5f937139dac6485d2bd8488f3b0e3
-
SHA256
fa166fc0fcb0dbb98bdeb60c340c54b1999d25180b392adad7141efeafe52b5b
-
SHA512
62cf0a29330e701214775d16a71b167f312e04290dd0f951dc838e61d8094019d9cf5d74adb32cfb2b9181f8e86869781e7693c69610c22ca466b877e54b0e9b
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frioLTJYH5:1dWubF3n9S91BF3fuoPJYH5
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1568-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 1568 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2996 wrote to memory of 1568 2996 rundll32.exe rundll32.exe PID 2996 wrote to memory of 1568 2996 rundll32.exe rundll32.exe PID 2996 wrote to memory of 1568 2996 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa166fc0fcb0dbb98bdeb60c340c54b1999d25180b392adad7141efeafe52b5b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa166fc0fcb0dbb98bdeb60c340c54b1999d25180b392adad7141efeafe52b5b.dll,#12⤵
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1568-0-0x0000000010000000-0x0000000010011000-memory.dmpFilesize
68KB