Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 08:46
Behavioral task
behavioral1
Sample
0ef9083ede4c183bbf7fca296b7854f539532e65b1e6daf85a735e4389d7f86b.dll
Resource
win7-20240220-en
4 signatures
150 seconds
General
-
Target
0ef9083ede4c183bbf7fca296b7854f539532e65b1e6daf85a735e4389d7f86b.dll
-
Size
51KB
-
MD5
b7b3c43064f9b7570100bcf91fe32243
-
SHA1
1ddac5c74d5f11ef655ad4b3657cced0476bceea
-
SHA256
0ef9083ede4c183bbf7fca296b7854f539532e65b1e6daf85a735e4389d7f86b
-
SHA512
ac659a07a6f93ba5af6d881baacece31b1585a39858a371c50961c8eb9b4ef492ce87cf9dc78d0c7081792e915fec8ebb884d04fe16d3e94c2693a7af78ebdbd
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLVJYH5:1dWubF3n9S91BF3fbopJYH5
Malware Config
Extracted
Family
gh0strat
C2
kinh.xmcxmr.com
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/3244-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3244 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3804 wrote to memory of 3244 3804 rundll32.exe 82 PID 3804 wrote to memory of 3244 3804 rundll32.exe 82 PID 3804 wrote to memory of 3244 3804 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ef9083ede4c183bbf7fca296b7854f539532e65b1e6daf85a735e4389d7f86b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ef9083ede4c183bbf7fca296b7854f539532e65b1e6daf85a735e4389d7f86b.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:3244
-