Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 00:29
Behavioral task
behavioral1
Sample
001690b298965b182113181c081fb8bd880857fe7dbc67fe97f7bc39c1f4ac54.dll
Resource
win7-20240215-en
4 signatures
150 seconds
General
-
Target
001690b298965b182113181c081fb8bd880857fe7dbc67fe97f7bc39c1f4ac54.dll
-
Size
50KB
-
MD5
7fddc597cde0b8985375fe49afda8f3d
-
SHA1
21fcdc48245e3a4993875923324c9820ca4e5b65
-
SHA256
001690b298965b182113181c081fb8bd880857fe7dbc67fe97f7bc39c1f4ac54
-
SHA512
9da942b9a13f4ac7d800cc52ed74682f19bd00df75620d36f21731a99724e2108e18ef011204158a140f61f807a9b3957266dc9272188f18648cc3b3bbe34f4c
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5sJYH:W5ReWjTrW9rNPgYoqJYH
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4292-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4292 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2816 wrote to memory of 4292 2816 rundll32.exe 83 PID 2816 wrote to memory of 4292 2816 rundll32.exe 83 PID 2816 wrote to memory of 4292 2816 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\001690b298965b182113181c081fb8bd880857fe7dbc67fe97f7bc39c1f4ac54.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\001690b298965b182113181c081fb8bd880857fe7dbc67fe97f7bc39c1f4ac54.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4292
-