Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-06-2024 06:29
Behavioral task
behavioral1
Sample
159c622af0c59ccbcf682efa268beae7f20f99e43ce5d4211a910c765692372f.dll
Resource
win7-20240221-en
7 signatures
150 seconds
General
-
Target
159c622af0c59ccbcf682efa268beae7f20f99e43ce5d4211a910c765692372f.dll
-
Size
10.8MB
-
MD5
4eebf23050b4f421bedd646fd4a7ee4b
-
SHA1
8737da68a0906bb64646ec86f6a248b8955d5b6f
-
SHA256
159c622af0c59ccbcf682efa268beae7f20f99e43ce5d4211a910c765692372f
-
SHA512
dd6bafbfa9c9dac4437746cdd43d003f8a454196cf05bcf3e7c3864236a41704e619473051a47ce90c58b195f2126d5f356b2e8c64e6b9e496a8af90e2669399
-
SSDEEP
196608:Mc+f6FB8D41QbQB0vIL4X7uhqn5/SbcPDYSIkkJFlJxxeQfTnQpHj65:Mc+f6z8D4ia0tX7usn5Ec8PJFlJxIqeM
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/928-0-0x0000000010000000-0x000000001002D000-memory.dmp family_gh0strat -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4164 wrote to memory of 928 4164 rundll32.exe rundll32.exe PID 4164 wrote to memory of 928 4164 rundll32.exe rundll32.exe PID 4164 wrote to memory of 928 4164 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\159c622af0c59ccbcf682efa268beae7f20f99e43ce5d4211a910c765692372f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\159c622af0c59ccbcf682efa268beae7f20f99e43ce5d4211a910c765692372f.dll,#12⤵PID:928