Analysis
-
max time kernel
141s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 08:25
Behavioral task
behavioral1
Sample
b016590f3b96548f6c97c3539cb7c3aa251795b4b7dbf08881905f6fdaae5cb6.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
b016590f3b96548f6c97c3539cb7c3aa251795b4b7dbf08881905f6fdaae5cb6.dll
-
Size
50KB
-
MD5
256a74274f8343491a107bae0333c1e0
-
SHA1
0bc838e62f441402b68c90a16dfef8e127faa175
-
SHA256
b016590f3b96548f6c97c3539cb7c3aa251795b4b7dbf08881905f6fdaae5cb6
-
SHA512
c142293412bd6713cfbfa3f447372bab850e2c165217d918e211ba4822deda7d2a3cb54251ad7ed1e3a7d407747a45974a2a761fb96a6bad61e236c634c4238f
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5/JYH:W5ReWjTrW9rNPgYoNJYH
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2800-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 2800 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4388 wrote to memory of 2800 4388 rundll32.exe rundll32.exe PID 4388 wrote to memory of 2800 4388 rundll32.exe rundll32.exe PID 4388 wrote to memory of 2800 4388 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b016590f3b96548f6c97c3539cb7c3aa251795b4b7dbf08881905f6fdaae5cb6.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b016590f3b96548f6c97c3539cb7c3aa251795b4b7dbf08881905f6fdaae5cb6.dll,#12⤵
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2800-0-0x0000000010000000-0x0000000010011000-memory.dmpFilesize
68KB