Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 18:43
Behavioral task
behavioral1
Sample
d6cbd71b751b65e780c31469bbff037c1420a070cba4cc015d16d17a9c5ebd53.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
d6cbd71b751b65e780c31469bbff037c1420a070cba4cc015d16d17a9c5ebd53.dll
-
Size
51KB
-
MD5
b6c7d96d31db800deac740ec7cad0643
-
SHA1
7ab6b660c92f61c491003472356fae9c523222fc
-
SHA256
d6cbd71b751b65e780c31469bbff037c1420a070cba4cc015d16d17a9c5ebd53
-
SHA512
58890b54f48fc18199f2963f4a76bddc0713fc8ce0e05b89f8afab5abf3cbeb7425f1bb47163d458be86e67c179ad2b55454894a54098ff7c116ad06a336bcce
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLSJYH5:1dWubF3n9S91BF3fbo+JYH5
Malware Config
Extracted
Family
gh0strat
C2
kinh.xmcxmr.com
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4764-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4764 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2212 wrote to memory of 4764 2212 rundll32.exe 91 PID 2212 wrote to memory of 4764 2212 rundll32.exe 91 PID 2212 wrote to memory of 4764 2212 rundll32.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d6cbd71b751b65e780c31469bbff037c1420a070cba4cc015d16d17a9c5ebd53.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d6cbd71b751b65e780c31469bbff037c1420a070cba4cc015d16d17a9c5ebd53.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4476 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:4900