Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 18:43
Behavioral task
behavioral1
Sample
d6cbd71b751b65e780c31469bbff037c1420a070cba4cc015d16d17a9c5ebd53.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
d6cbd71b751b65e780c31469bbff037c1420a070cba4cc015d16d17a9c5ebd53.dll
-
Size
51KB
-
MD5
b6c7d96d31db800deac740ec7cad0643
-
SHA1
7ab6b660c92f61c491003472356fae9c523222fc
-
SHA256
d6cbd71b751b65e780c31469bbff037c1420a070cba4cc015d16d17a9c5ebd53
-
SHA512
58890b54f48fc18199f2963f4a76bddc0713fc8ce0e05b89f8afab5abf3cbeb7425f1bb47163d458be86e67c179ad2b55454894a54098ff7c116ad06a336bcce
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLSJYH5:1dWubF3n9S91BF3fbo+JYH5
Malware Config
Extracted
Family
gh0strat
C2
kinh.xmcxmr.com
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/1456-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1456 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1456 2236 rundll32.exe 28 PID 2236 wrote to memory of 1456 2236 rundll32.exe 28 PID 2236 wrote to memory of 1456 2236 rundll32.exe 28 PID 2236 wrote to memory of 1456 2236 rundll32.exe 28 PID 2236 wrote to memory of 1456 2236 rundll32.exe 28 PID 2236 wrote to memory of 1456 2236 rundll32.exe 28 PID 2236 wrote to memory of 1456 2236 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d6cbd71b751b65e780c31469bbff037c1420a070cba4cc015d16d17a9c5ebd53.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d6cbd71b751b65e780c31469bbff037c1420a070cba4cc015d16d17a9c5ebd53.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:1456
-