Analysis
-
max time kernel
142s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 01:29
Behavioral task
behavioral1
Sample
6db21849fa6d79cbb9c37de74d2eac0c448a6bf40016ed628006452817e8729e.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
6db21849fa6d79cbb9c37de74d2eac0c448a6bf40016ed628006452817e8729e.dll
-
Size
50KB
-
MD5
c1ec9a4de1044b03c81c5bcc7ce63785
-
SHA1
02c2e3688dd9e2a12e4d33ab5ae81479365a82fb
-
SHA256
6db21849fa6d79cbb9c37de74d2eac0c448a6bf40016ed628006452817e8729e
-
SHA512
1583f3b20c91df877b741888027099e9e57d53d1e52993515309308333dfb2c843c7771bfc58973e5782808eb1289bcc7bd2ba93f7e7b81781271add2ca9c2aa
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5ZJYH:W5ReWjTrW9rNPgYojJYH
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2272-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2272 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2272 2244 rundll32.exe 28 PID 2244 wrote to memory of 2272 2244 rundll32.exe 28 PID 2244 wrote to memory of 2272 2244 rundll32.exe 28 PID 2244 wrote to memory of 2272 2244 rundll32.exe 28 PID 2244 wrote to memory of 2272 2244 rundll32.exe 28 PID 2244 wrote to memory of 2272 2244 rundll32.exe 28 PID 2244 wrote to memory of 2272 2244 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6db21849fa6d79cbb9c37de74d2eac0c448a6bf40016ed628006452817e8729e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6db21849fa6d79cbb9c37de74d2eac0c448a6bf40016ed628006452817e8729e.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2272
-