Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 03:07
Behavioral task
behavioral1
Sample
8c90ea2a240ff072b01b0e467b9d75802bce0c3bfde325f578aaa9c361eadc05.dll
Resource
win7-20240220-en
4 signatures
150 seconds
General
-
Target
8c90ea2a240ff072b01b0e467b9d75802bce0c3bfde325f578aaa9c361eadc05.dll
-
Size
50KB
-
MD5
9aec3b2fd3d0480e3248018291d6c365
-
SHA1
b5117397645a90591585b23db8f3158c990012b2
-
SHA256
8c90ea2a240ff072b01b0e467b9d75802bce0c3bfde325f578aaa9c361eadc05
-
SHA512
cbb68e693c4cdb424de3bc91cfbbecd0cc04e5db068e050d4f341d22bdb8dc8f60575d33360c0b3b51ca78e92dc205054468f711b212a59347879f60f043289c
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5nJYH:W5ReWjTrW9rNPgYoFJYH
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4324-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4324 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4552 wrote to memory of 4324 4552 rundll32.exe 84 PID 4552 wrote to memory of 4324 4552 rundll32.exe 84 PID 4552 wrote to memory of 4324 4552 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c90ea2a240ff072b01b0e467b9d75802bce0c3bfde325f578aaa9c361eadc05.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c90ea2a240ff072b01b0e467b9d75802bce0c3bfde325f578aaa9c361eadc05.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4324
-