Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 02:29
Behavioral task
behavioral1
Sample
99f4b8d5e63b91652bfc64df9a35d06b964ed88a578aa0b55b284643fa2a871c.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
99f4b8d5e63b91652bfc64df9a35d06b964ed88a578aa0b55b284643fa2a871c.dll
-
Size
51KB
-
MD5
54d8b24ecf3187a8a085da9c70c4f7b9
-
SHA1
db7e9a88dd15c1afd47510c59818a845c3812d8b
-
SHA256
99f4b8d5e63b91652bfc64df9a35d06b964ed88a578aa0b55b284643fa2a871c
-
SHA512
f9c814ddd661d489b2fc5ea010ba8a9c1abd2efeed511b88097c4cc8a937c096e33629feac5966d01d3d47479729958773595f5e19475f5d52255176b2b15c5f
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLeJYH5:1dWubF3n9S91BF3fbo6JYH5
Malware Config
Extracted
Family
gh0strat
C2
kinh.xmcxmr.com
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2992-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2992 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\99f4b8d5e63b91652bfc64df9a35d06b964ed88a578aa0b55b284643fa2a871c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\99f4b8d5e63b91652bfc64df9a35d06b964ed88a578aa0b55b284643fa2a871c.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2992
-