Analysis
-
max time kernel
140s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 18:49
Behavioral task
behavioral1
Sample
ff5fa3f6c13016b3e14b44d31fa91bb69a345b9320e81a31d3b1c46e63461c9e.dll
Resource
win7-20240611-en
4 signatures
150 seconds
General
-
Target
ff5fa3f6c13016b3e14b44d31fa91bb69a345b9320e81a31d3b1c46e63461c9e.dll
-
Size
899KB
-
MD5
3651b822225525cfeff848d79c18ccc2
-
SHA1
4d318384949442fafc9b10df2524ca58be550888
-
SHA256
ff5fa3f6c13016b3e14b44d31fa91bb69a345b9320e81a31d3b1c46e63461c9e
-
SHA512
4c2c1e0f8fbe6fc251fa6cae62cab82117c3856c189ee6059af71c77df530e216009ce9aa5ce41e3055d32a2f89bb1e74fda155a2a6e24d4711295aadf9d2387
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXP:7wqd87VP
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/1800-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1800 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3296 wrote to memory of 1800 3296 rundll32.exe 88 PID 3296 wrote to memory of 1800 3296 rundll32.exe 88 PID 3296 wrote to memory of 1800 3296 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff5fa3f6c13016b3e14b44d31fa91bb69a345b9320e81a31d3b1c46e63461c9e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff5fa3f6c13016b3e14b44d31fa91bb69a345b9320e81a31d3b1c46e63461c9e.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:1800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3800,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:81⤵PID:1108