Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 17:46
Behavioral task
behavioral1
Sample
35203e3a94fb89b0c8404b224126489086b8d38935e71227833669831a9d9b5d.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
35203e3a94fb89b0c8404b224126489086b8d38935e71227833669831a9d9b5d.dll
-
Size
50KB
-
MD5
5bba8f036a460924bf1f560dc5824a4a
-
SHA1
0fb1dcaed86657c119cd39c13208d3d091cac656
-
SHA256
35203e3a94fb89b0c8404b224126489086b8d38935e71227833669831a9d9b5d
-
SHA512
9540e35003434d12af49c11bdc1a2d7e25f0d27b9bbb0a643131d8b6522f9ebd03371105478f67f64e61af00a1950ace8e9686876469ca2de9927d007a8c78f0
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5YJYH:W5ReWjTrW9rNPgYo6JYH
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2080-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2080 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1264 wrote to memory of 2080 1264 rundll32.exe 28 PID 1264 wrote to memory of 2080 1264 rundll32.exe 28 PID 1264 wrote to memory of 2080 1264 rundll32.exe 28 PID 1264 wrote to memory of 2080 1264 rundll32.exe 28 PID 1264 wrote to memory of 2080 1264 rundll32.exe 28 PID 1264 wrote to memory of 2080 1264 rundll32.exe 28 PID 1264 wrote to memory of 2080 1264 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35203e3a94fb89b0c8404b224126489086b8d38935e71227833669831a9d9b5d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35203e3a94fb89b0c8404b224126489086b8d38935e71227833669831a9d9b5d.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2080
-