Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 17:46
Behavioral task
behavioral1
Sample
35203e3a94fb89b0c8404b224126489086b8d38935e71227833669831a9d9b5d.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
35203e3a94fb89b0c8404b224126489086b8d38935e71227833669831a9d9b5d.dll
-
Size
50KB
-
MD5
5bba8f036a460924bf1f560dc5824a4a
-
SHA1
0fb1dcaed86657c119cd39c13208d3d091cac656
-
SHA256
35203e3a94fb89b0c8404b224126489086b8d38935e71227833669831a9d9b5d
-
SHA512
9540e35003434d12af49c11bdc1a2d7e25f0d27b9bbb0a643131d8b6522f9ebd03371105478f67f64e61af00a1950ace8e9686876469ca2de9927d007a8c78f0
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5YJYH:W5ReWjTrW9rNPgYo6JYH
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2568-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2568 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4684 wrote to memory of 2568 4684 rundll32.exe 80 PID 4684 wrote to memory of 2568 4684 rundll32.exe 80 PID 4684 wrote to memory of 2568 4684 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35203e3a94fb89b0c8404b224126489086b8d38935e71227833669831a9d9b5d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\35203e3a94fb89b0c8404b224126489086b8d38935e71227833669831a9d9b5d.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2568
-