Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 18:49
Behavioral task
behavioral1
Sample
e15dd92639db3bbfbb26ad16e401fe6c8bd801999b9e48c648b7380f2af8a386.dll
Resource
win7-20240611-en
4 signatures
150 seconds
General
-
Target
e15dd92639db3bbfbb26ad16e401fe6c8bd801999b9e48c648b7380f2af8a386.dll
-
Size
899KB
-
MD5
828cf3edc07ddfef9d60d072c962fc9e
-
SHA1
a874bb4dd6a8391af2c6e1b1bc73796a93057685
-
SHA256
e15dd92639db3bbfbb26ad16e401fe6c8bd801999b9e48c648b7380f2af8a386
-
SHA512
d1ce49d84dde3b01835bee86990cb50687e7161da1a027b20d097a675bd23db535fbece620ec2d09540236354a8ff94202ff3f28fcf3f8ca37358748c00b7aae
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX2:7wqd87V2
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/3436-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3436 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2116 wrote to memory of 3436 2116 rundll32.exe 82 PID 2116 wrote to memory of 3436 2116 rundll32.exe 82 PID 2116 wrote to memory of 3436 2116 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e15dd92639db3bbfbb26ad16e401fe6c8bd801999b9e48c648b7380f2af8a386.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e15dd92639db3bbfbb26ad16e401fe6c8bd801999b9e48c648b7380f2af8a386.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:3436
-