Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 21:43
Behavioral task
behavioral1
Sample
db9c527dd488a30fd80380b32cbb49bae3c336624ea1734077606174516ee3b8.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
db9c527dd488a30fd80380b32cbb49bae3c336624ea1734077606174516ee3b8.dll
-
Size
899KB
-
MD5
ee795225056d7f847aae846ae5c64ea1
-
SHA1
d2d40581929ab9e0ec7f33bfd6ff7ee744e6858c
-
SHA256
db9c527dd488a30fd80380b32cbb49bae3c336624ea1734077606174516ee3b8
-
SHA512
e3515f652295b4d8a73a11940de418855b8d4e21184878471d74406653c285360fe94d831b7d614a86b75e58dd46c87ca4ca4aa73e488d93e642eabfcf8d18da
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXP:7wqd87VP
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2008-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2008 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2008 2296 rundll32.exe 28 PID 2296 wrote to memory of 2008 2296 rundll32.exe 28 PID 2296 wrote to memory of 2008 2296 rundll32.exe 28 PID 2296 wrote to memory of 2008 2296 rundll32.exe 28 PID 2296 wrote to memory of 2008 2296 rundll32.exe 28 PID 2296 wrote to memory of 2008 2296 rundll32.exe 28 PID 2296 wrote to memory of 2008 2296 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\db9c527dd488a30fd80380b32cbb49bae3c336624ea1734077606174516ee3b8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\db9c527dd488a30fd80380b32cbb49bae3c336624ea1734077606174516ee3b8.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2008
-