Analysis
-
max time kernel
146s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 17:46
Behavioral task
behavioral1
Sample
ad8f250c68fd3b036f950f2762e49581ba1201d4520fd4bd2b73551012515cef.dll
Resource
win7-20240611-en
4 signatures
150 seconds
General
-
Target
ad8f250c68fd3b036f950f2762e49581ba1201d4520fd4bd2b73551012515cef.dll
-
Size
899KB
-
MD5
27bcd2d96bbc70397d90636126949206
-
SHA1
8ce1b33871a5a53bae96b56aa8b73863aae23914
-
SHA256
ad8f250c68fd3b036f950f2762e49581ba1201d4520fd4bd2b73551012515cef
-
SHA512
96f783adfdecb22021fe7d2890434a2a61e0e5d00a6b303c203455efaa50f894a094e6e854fa440bb60d9bb0e05e88ec0afa1fcc9cd21c9c7ba9c4177b17e3e8
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXU:7wqd87VU
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2464-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2464 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4248 wrote to memory of 2464 4248 rundll32.exe 90 PID 4248 wrote to memory of 2464 4248 rundll32.exe 90 PID 4248 wrote to memory of 2464 4248 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad8f250c68fd3b036f950f2762e49581ba1201d4520fd4bd2b73551012515cef.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad8f250c68fd3b036f950f2762e49581ba1201d4520fd4bd2b73551012515cef.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:3164