Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 18:43
Behavioral task
behavioral1
Sample
9527e9122565befb45e889f8ce0eb65d3b9ed6c7cb14e2b93aecc157378f98eb.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
9527e9122565befb45e889f8ce0eb65d3b9ed6c7cb14e2b93aecc157378f98eb.dll
-
Size
899KB
-
MD5
0ef85e17c106296a12ffdfb694630df8
-
SHA1
449c34cd3d74ff208fa498bfce472d42e0b3b205
-
SHA256
9527e9122565befb45e889f8ce0eb65d3b9ed6c7cb14e2b93aecc157378f98eb
-
SHA512
c4720c304d40da6af7004f57b4d412a60225cc8f8c1eb87b341abd610595b02c9b6f827556c4231ab322adf1cc0cacddebb42d1ecf66d0a93b0a8de09291b474
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXT:7wqd87VT
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/1756-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1756 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4436 wrote to memory of 1756 4436 rundll32.exe 91 PID 4436 wrote to memory of 1756 4436 rundll32.exe 91 PID 4436 wrote to memory of 1756 4436 rundll32.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9527e9122565befb45e889f8ce0eb65d3b9ed6c7cb14e2b93aecc157378f98eb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9527e9122565befb45e889f8ce0eb65d3b9ed6c7cb14e2b93aecc157378f98eb.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:81⤵PID:5084