Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 23:38
Behavioral task
behavioral1
Sample
2e962505456dd8da1cfeb9ed2cea4dd6dc686814436d51ffac2a3b6359341257.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
2e962505456dd8da1cfeb9ed2cea4dd6dc686814436d51ffac2a3b6359341257.dll
-
Size
899KB
-
MD5
a20728bee239b98b8339740b889e8e03
-
SHA1
d230bf521618ba303647f21d2b672b0e8de67719
-
SHA256
2e962505456dd8da1cfeb9ed2cea4dd6dc686814436d51ffac2a3b6359341257
-
SHA512
9ee33a295290881feb39d78f4ee721f187042cc589530423bd1dcb4c6c1354f8aecbe126329c527dc775271a48add82d32dd666175ce70bb397310e3cc9ce48c
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXK:7wqd87VK
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/1936-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1936 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5036 wrote to memory of 1936 5036 rundll32.exe 85 PID 5036 wrote to memory of 1936 5036 rundll32.exe 85 PID 5036 wrote to memory of 1936 5036 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e962505456dd8da1cfeb9ed2cea4dd6dc686814436d51ffac2a3b6359341257.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e962505456dd8da1cfeb9ed2cea4dd6dc686814436d51ffac2a3b6359341257.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:1936
-