Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
58s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 21:43
Behavioral task
behavioral1
Sample
db9c527dd488a30fd80380b32cbb49bae3c336624ea1734077606174516ee3b8.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
db9c527dd488a30fd80380b32cbb49bae3c336624ea1734077606174516ee3b8.dll
-
Size
899KB
-
MD5
ee795225056d7f847aae846ae5c64ea1
-
SHA1
d2d40581929ab9e0ec7f33bfd6ff7ee744e6858c
-
SHA256
db9c527dd488a30fd80380b32cbb49bae3c336624ea1734077606174516ee3b8
-
SHA512
e3515f652295b4d8a73a11940de418855b8d4e21184878471d74406653c285360fe94d831b7d614a86b75e58dd46c87ca4ca4aa73e488d93e642eabfcf8d18da
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXP:7wqd87VP
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2284-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2284 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3952 wrote to memory of 2284 3952 rundll32.exe 81 PID 3952 wrote to memory of 2284 3952 rundll32.exe 81 PID 3952 wrote to memory of 2284 3952 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\db9c527dd488a30fd80380b32cbb49bae3c336624ea1734077606174516ee3b8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\db9c527dd488a30fd80380b32cbb49bae3c336624ea1734077606174516ee3b8.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2284
-