Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 09:57
Behavioral task
behavioral1
Sample
31880ffe0a10df6adb89148e65a6b8f08e151a5513efdac42e8f95c8d8864bc8.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
31880ffe0a10df6adb89148e65a6b8f08e151a5513efdac42e8f95c8d8864bc8.dll
-
Size
899KB
-
MD5
2a0e556954cf2c2f2d19ffdbb0c729cc
-
SHA1
e721684351dfe6f527a57c6a280d8ebf81f8866b
-
SHA256
31880ffe0a10df6adb89148e65a6b8f08e151a5513efdac42e8f95c8d8864bc8
-
SHA512
61728655f7f0fdfe8c7989472588d1f6e28850ae4b39f98e220336593f3b5a654b983955dd6798b6f18bf85cbf38af0b5d3767a0a58b4a4049eae22232c012c3
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX8:7wqd87V8
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4076-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4076 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3208 wrote to memory of 4076 3208 rundll32.exe 82 PID 3208 wrote to memory of 4076 3208 rundll32.exe 82 PID 3208 wrote to memory of 4076 3208 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\31880ffe0a10df6adb89148e65a6b8f08e151a5513efdac42e8f95c8d8864bc8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\31880ffe0a10df6adb89148e65a6b8f08e151a5513efdac42e8f95c8d8864bc8.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4076
-