Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 13:32
Behavioral task
behavioral1
Sample
dadcf206045f6cc5115f957257e33de0bc590362abf2a872be7ceb9b1a60f9e6.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
dadcf206045f6cc5115f957257e33de0bc590362abf2a872be7ceb9b1a60f9e6.dll
-
Size
899KB
-
MD5
81d19867b988e11aecf3779d7d19b301
-
SHA1
677c5c5ca531b6d740b8d532c2372efb8f695f94
-
SHA256
dadcf206045f6cc5115f957257e33de0bc590362abf2a872be7ceb9b1a60f9e6
-
SHA512
20d0361ad8ab209e0a292ee3d4a2a68a60dd6b0f381d2ff7ad53eeb9d50b8a4f0ceed6a76d4c5f43ea27b90a21e1b167e7b8e7ebc9d815daa5ed913d0238dad2
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXq:7wqd87Vq
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1332-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 1332 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3516 wrote to memory of 1332 3516 rundll32.exe rundll32.exe PID 3516 wrote to memory of 1332 3516 rundll32.exe rundll32.exe PID 3516 wrote to memory of 1332 3516 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dadcf206045f6cc5115f957257e33de0bc590362abf2a872be7ceb9b1a60f9e6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dadcf206045f6cc5115f957257e33de0bc590362abf2a872be7ceb9b1a60f9e6.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:1332