Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-06-2024 18:43

General

  • Target

    83e81c280975dc6919a311a1da9ceb113e5db9b56eb794ef4661ceddf20bb442.dll

  • Size

    51KB

  • MD5

    ee07b64f7ff571495a493654043ff189

  • SHA1

    6b41a7319bb97e57a56fc27f47a88e4b6d7411db

  • SHA256

    83e81c280975dc6919a311a1da9ceb113e5db9b56eb794ef4661ceddf20bb442

  • SHA512

    a06fc3c211dde6f4101da91d6d6e38d103d7221807faf975bf75f220b47293bf4052a27256373bc635edaa61d4f67fb4fe4a2ac46cd4207ad5a8d881fe597a33

  • SSDEEP

    1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL9JYH5:1dWubF3n9S91BF3fboRJYH5

Score
10/10

Malware Config

Extracted

Family

gh0strat

C2

kinh.xmcxmr.com

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\83e81c280975dc6919a311a1da9ceb113e5db9b56eb794ef4661ceddf20bb442.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4600
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\83e81c280975dc6919a311a1da9ceb113e5db9b56eb794ef4661ceddf20bb442.dll,#1
      2⤵
      • Suspicious behavior: RenamesItself
      PID:4512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4512-0-0x0000000010000000-0x0000000010011000-memory.dmp

    Filesize

    68KB