Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 01:29
Behavioral task
behavioral1
Sample
6db21849fa6d79cbb9c37de74d2eac0c448a6bf40016ed628006452817e8729e.dll
Resource
win7-20240221-en
4 signatures
150 seconds
General
-
Target
6db21849fa6d79cbb9c37de74d2eac0c448a6bf40016ed628006452817e8729e.dll
-
Size
50KB
-
MD5
c1ec9a4de1044b03c81c5bcc7ce63785
-
SHA1
02c2e3688dd9e2a12e4d33ab5ae81479365a82fb
-
SHA256
6db21849fa6d79cbb9c37de74d2eac0c448a6bf40016ed628006452817e8729e
-
SHA512
1583f3b20c91df877b741888027099e9e57d53d1e52993515309308333dfb2c843c7771bfc58973e5782808eb1289bcc7bd2ba93f7e7b81781271add2ca9c2aa
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5ZJYH:W5ReWjTrW9rNPgYojJYH
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/3644-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3644 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2748 wrote to memory of 3644 2748 rundll32.exe 83 PID 2748 wrote to memory of 3644 2748 rundll32.exe 83 PID 2748 wrote to memory of 3644 2748 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6db21849fa6d79cbb9c37de74d2eac0c448a6bf40016ed628006452817e8729e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6db21849fa6d79cbb9c37de74d2eac0c448a6bf40016ed628006452817e8729e.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:3644
-