Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 05:43
Behavioral task
behavioral1
Sample
c7cb4979cdd46b216b77d343e94ea76bd29e80c74cca86c2f2e5a2b40632f323.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
c7cb4979cdd46b216b77d343e94ea76bd29e80c74cca86c2f2e5a2b40632f323.dll
-
Size
51KB
-
MD5
ebec56f7bf5a15fa247a739acfc329ed
-
SHA1
2622abe4b8c4a3a6d946fc7186306c519e1d1c63
-
SHA256
c7cb4979cdd46b216b77d343e94ea76bd29e80c74cca86c2f2e5a2b40632f323
-
SHA512
50dc4925ccd42cc7c8f6ed0bac1efd0663c5d5c3666a42b1755b81420925df0f3c606b9548f0ee44458aa7063c5934dc4738c3dda851d86d4c1be973f6054722
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frxroLxJYH5:1dWubF3n9S91BF3fNro1JYH5
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2132-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 2132 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2140 wrote to memory of 2132 2140 rundll32.exe rundll32.exe PID 2140 wrote to memory of 2132 2140 rundll32.exe rundll32.exe PID 2140 wrote to memory of 2132 2140 rundll32.exe rundll32.exe PID 2140 wrote to memory of 2132 2140 rundll32.exe rundll32.exe PID 2140 wrote to memory of 2132 2140 rundll32.exe rundll32.exe PID 2140 wrote to memory of 2132 2140 rundll32.exe rundll32.exe PID 2140 wrote to memory of 2132 2140 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c7cb4979cdd46b216b77d343e94ea76bd29e80c74cca86c2f2e5a2b40632f323.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c7cb4979cdd46b216b77d343e94ea76bd29e80c74cca86c2f2e5a2b40632f323.dll,#12⤵
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2132-0-0x0000000010000000-0x0000000010011000-memory.dmpFilesize
68KB