Analysis
-
max time kernel
120s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 06:29
Behavioral task
behavioral1
Sample
159c622af0c59ccbcf682efa268beae7f20f99e43ce5d4211a910c765692372f.dll
Resource
win7-20240221-en
7 signatures
150 seconds
General
-
Target
159c622af0c59ccbcf682efa268beae7f20f99e43ce5d4211a910c765692372f.dll
-
Size
10.8MB
-
MD5
4eebf23050b4f421bedd646fd4a7ee4b
-
SHA1
8737da68a0906bb64646ec86f6a248b8955d5b6f
-
SHA256
159c622af0c59ccbcf682efa268beae7f20f99e43ce5d4211a910c765692372f
-
SHA512
dd6bafbfa9c9dac4437746cdd43d003f8a454196cf05bcf3e7c3864236a41704e619473051a47ce90c58b195f2126d5f356b2e8c64e6b9e496a8af90e2669399
-
SSDEEP
196608:Mc+f6FB8D41QbQB0vIL4X7uhqn5/SbcPDYSIkkJFlJxxeQfTnQpHj65:Mc+f6z8D4ia0tX7usn5Ec8PJFlJxIqeM
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1920-1-0x0000000010000000-0x000000001002D000-memory.dmp family_gh0strat -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 3 1920 rundll32.exe 7 1920 rundll32.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
rundll32.exepid process 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2020 wrote to memory of 1920 2020 rundll32.exe rundll32.exe PID 2020 wrote to memory of 1920 2020 rundll32.exe rundll32.exe PID 2020 wrote to memory of 1920 2020 rundll32.exe rundll32.exe PID 2020 wrote to memory of 1920 2020 rundll32.exe rundll32.exe PID 2020 wrote to memory of 1920 2020 rundll32.exe rundll32.exe PID 2020 wrote to memory of 1920 2020 rundll32.exe rundll32.exe PID 2020 wrote to memory of 1920 2020 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\159c622af0c59ccbcf682efa268beae7f20f99e43ce5d4211a910c765692372f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\159c622af0c59ccbcf682efa268beae7f20f99e43ce5d4211a910c765692372f.dll,#12⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1920