Analysis
-
max time kernel
145s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 06:57
Behavioral task
behavioral1
Sample
4f9e4ff1c49eb5ecb7c4de6a20031a1f69531031b886621b08e2ea0a0fe4b5d9.dll
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
General
-
Target
4f9e4ff1c49eb5ecb7c4de6a20031a1f69531031b886621b08e2ea0a0fe4b5d9.dll
-
Size
899KB
-
MD5
574b2f1de5e277433a27b8df90fcaedd
-
SHA1
d0d5d2312edaaa6e102206e43db6c742893dac7e
-
SHA256
4f9e4ff1c49eb5ecb7c4de6a20031a1f69531031b886621b08e2ea0a0fe4b5d9
-
SHA512
d52cf7d1bf545557ca0fbcd42ad19200a8519d69144cb02735b5179cec1d86642fef668c55cb4a44c0131b9ef0783edddbc517d15f96798ccd688f7dc5cfd088
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXn:7wqd87Vn
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3500-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 3500 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4500 wrote to memory of 3500 4500 rundll32.exe rundll32.exe PID 4500 wrote to memory of 3500 4500 rundll32.exe rundll32.exe PID 4500 wrote to memory of 3500 4500 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4f9e4ff1c49eb5ecb7c4de6a20031a1f69531031b886621b08e2ea0a0fe4b5d9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4f9e4ff1c49eb5ecb7c4de6a20031a1f69531031b886621b08e2ea0a0fe4b5d9.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:3500
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3500-0-0x0000000010000000-0x000000001014F000-memory.dmpFilesize
1.3MB