Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 18:49
Behavioral task
behavioral1
Sample
e15dd92639db3bbfbb26ad16e401fe6c8bd801999b9e48c648b7380f2af8a386.dll
Resource
win7-20240611-en
4 signatures
150 seconds
General
-
Target
e15dd92639db3bbfbb26ad16e401fe6c8bd801999b9e48c648b7380f2af8a386.dll
-
Size
899KB
-
MD5
828cf3edc07ddfef9d60d072c962fc9e
-
SHA1
a874bb4dd6a8391af2c6e1b1bc73796a93057685
-
SHA256
e15dd92639db3bbfbb26ad16e401fe6c8bd801999b9e48c648b7380f2af8a386
-
SHA512
d1ce49d84dde3b01835bee86990cb50687e7161da1a027b20d097a675bd23db535fbece620ec2d09540236354a8ff94202ff3f28fcf3f8ca37358748c00b7aae
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX2:7wqd87V2
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2344-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2344 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2344 2280 rundll32.exe 28 PID 2280 wrote to memory of 2344 2280 rundll32.exe 28 PID 2280 wrote to memory of 2344 2280 rundll32.exe 28 PID 2280 wrote to memory of 2344 2280 rundll32.exe 28 PID 2280 wrote to memory of 2344 2280 rundll32.exe 28 PID 2280 wrote to memory of 2344 2280 rundll32.exe 28 PID 2280 wrote to memory of 2344 2280 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e15dd92639db3bbfbb26ad16e401fe6c8bd801999b9e48c648b7380f2af8a386.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e15dd92639db3bbfbb26ad16e401fe6c8bd801999b9e48c648b7380f2af8a386.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2344
-