Analysis
-
max time kernel
140s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 17:20
Behavioral task
behavioral1
Sample
482d6594c1e8864ed20892b7998fe1c09ddcf13a9eada0c4d585de053371e17e.dll
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
482d6594c1e8864ed20892b7998fe1c09ddcf13a9eada0c4d585de053371e17e.dll
-
Size
51KB
-
MD5
cbe9c0d04bb8f7cb5cc573c170523cc1
-
SHA1
f9b056e204c259b44beb7b3bc4daafb44866d2e0
-
SHA256
482d6594c1e8864ed20892b7998fe1c09ddcf13a9eada0c4d585de053371e17e
-
SHA512
41011f4032db34e9a3b1039e548186c5be551fb53a3d71c0492ea2cc8f03af6981d51db9f462f8b4a4115e1cdbf5c136753700791eec592147a257b6595b8cc8
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frRoLoJYH5:1dWubF3n9S91BF3fFoMJYH5
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3040-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 3040 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1236 wrote to memory of 3040 1236 rundll32.exe rundll32.exe PID 1236 wrote to memory of 3040 1236 rundll32.exe rundll32.exe PID 1236 wrote to memory of 3040 1236 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\482d6594c1e8864ed20892b7998fe1c09ddcf13a9eada0c4d585de053371e17e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\482d6594c1e8864ed20892b7998fe1c09ddcf13a9eada0c4d585de053371e17e.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:3040
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4172,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:81⤵PID:3412
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3040-0-0x0000000010000000-0x0000000010011000-memory.dmpFilesize
68KB