Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 20:43
Behavioral task
behavioral1
Sample
9ce0ab352275faecaca6af0264fc36603cceb6371f328681ebde5f215865ccad.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
9ce0ab352275faecaca6af0264fc36603cceb6371f328681ebde5f215865ccad.dll
-
Size
51KB
-
MD5
e3f48cc3ae60033e09f430a40637c06c
-
SHA1
ffd962881e1bf28963c51ce6822c6c2777cec692
-
SHA256
9ce0ab352275faecaca6af0264fc36603cceb6371f328681ebde5f215865ccad
-
SHA512
54453e4fb7150ce689ceb24e5348abe10a5943e830c4e03b7677b8ca194c478b3e93c454ff71a75c9101fa881fd4f2efcb08d48fd59ff4e7aacc1a53d089e8d4
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frfoLSJYH5:1dWubF3n9S91BF3fjoOJYH5
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2212-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 2212 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 3000 wrote to memory of 2212 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 2212 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 2212 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 2212 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 2212 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 2212 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 2212 3000 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9ce0ab352275faecaca6af0264fc36603cceb6371f328681ebde5f215865ccad.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9ce0ab352275faecaca6af0264fc36603cceb6371f328681ebde5f215865ccad.dll,#12⤵
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2212-0-0x0000000010000000-0x0000000010011000-memory.dmpFilesize
68KB