Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 23:46
Behavioral task
behavioral1
Sample
9364004378fe99ea36109620464f30319d7e9367e536c852244daa44535d0024.dll
Resource
win7-20240611-en
4 signatures
150 seconds
General
-
Target
9364004378fe99ea36109620464f30319d7e9367e536c852244daa44535d0024.dll
-
Size
899KB
-
MD5
830a3d5e9bf8ca03c37020fdb375da37
-
SHA1
76e616d53e0c2a74e39d72650c97cb7ef669fe51
-
SHA256
9364004378fe99ea36109620464f30319d7e9367e536c852244daa44535d0024
-
SHA512
c8cce65e8817be2a0b0f3285dc9df641d0eedc7deef10e7be6b87e65f9b57aafb5a246a9a67805d78e4c0de9ac6413220b360d38ed2041d4d04a02dceeabb5b6
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXs:7wqd87Vs
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2184-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2184 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1564 wrote to memory of 2184 1564 rundll32.exe 28 PID 1564 wrote to memory of 2184 1564 rundll32.exe 28 PID 1564 wrote to memory of 2184 1564 rundll32.exe 28 PID 1564 wrote to memory of 2184 1564 rundll32.exe 28 PID 1564 wrote to memory of 2184 1564 rundll32.exe 28 PID 1564 wrote to memory of 2184 1564 rundll32.exe 28 PID 1564 wrote to memory of 2184 1564 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9364004378fe99ea36109620464f30319d7e9367e536c852244daa44535d0024.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9364004378fe99ea36109620464f30319d7e9367e536c852244daa44535d0024.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2184
-