Analysis
-
max time kernel
146s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 18:15
Behavioral task
behavioral1
Sample
5a961130130e022a37ab73a12601df5c0cb8be30e3588a75d6cd8a26d28ca5eb.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
5a961130130e022a37ab73a12601df5c0cb8be30e3588a75d6cd8a26d28ca5eb.dll
-
Size
50KB
-
MD5
2a693de8656dd37ccc595cc8101904f0
-
SHA1
e0dffada4bcf4a5c8938a21746728bf13099103b
-
SHA256
5a961130130e022a37ab73a12601df5c0cb8be30e3588a75d6cd8a26d28ca5eb
-
SHA512
ba60065958617aa9908328909e5cb16ca8ab524ca8b0a1b9c8617e7cec834aae6e1705fd138a000e5e082f4b4309b1e292c2ba1f4ce0b31b653a9cb9c0dd0e91
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5DJYH:W5ReWjTrW9rNPgYo1JYH
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3092-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 3092 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2920 wrote to memory of 3092 2920 rundll32.exe rundll32.exe PID 2920 wrote to memory of 3092 2920 rundll32.exe rundll32.exe PID 2920 wrote to memory of 3092 2920 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a961130130e022a37ab73a12601df5c0cb8be30e3588a75d6cd8a26d28ca5eb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a961130130e022a37ab73a12601df5c0cb8be30e3588a75d6cd8a26d28ca5eb.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:3092
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3092-0-0x0000000010000000-0x0000000010011000-memory.dmpFilesize
68KB