Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 22:32
Behavioral task
behavioral1
Sample
52887f6e4b1071a7ee65be135463eec6028090a241e1ee705f17cbe5b9526472.dll
Resource
win7-20231129-en
4 signatures
150 seconds
General
-
Target
52887f6e4b1071a7ee65be135463eec6028090a241e1ee705f17cbe5b9526472.dll
-
Size
899KB
-
MD5
cc041059270a59488ff185550287ba8b
-
SHA1
57a3c8c4cb0b8d2355c67abbfd2c55f34a86f488
-
SHA256
52887f6e4b1071a7ee65be135463eec6028090a241e1ee705f17cbe5b9526472
-
SHA512
39c7c69f7aac1e7600956db7ab959cb571382fdd7ac751035693aafbfc12c5739826d1c35c3e08c7a628eabc8ee3af60b05b8cfd234ebb42dc7888b6e772e48e
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXF:7wqd87VF
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2528-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 2528 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2060 wrote to memory of 2528 2060 rundll32.exe rundll32.exe PID 2060 wrote to memory of 2528 2060 rundll32.exe rundll32.exe PID 2060 wrote to memory of 2528 2060 rundll32.exe rundll32.exe PID 2060 wrote to memory of 2528 2060 rundll32.exe rundll32.exe PID 2060 wrote to memory of 2528 2060 rundll32.exe rundll32.exe PID 2060 wrote to memory of 2528 2060 rundll32.exe rundll32.exe PID 2060 wrote to memory of 2528 2060 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\52887f6e4b1071a7ee65be135463eec6028090a241e1ee705f17cbe5b9526472.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\52887f6e4b1071a7ee65be135463eec6028090a241e1ee705f17cbe5b9526472.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2528