Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 21:43
Behavioral task
behavioral1
Sample
95cceb588397fa999160ce70c697f40f28a594ebf3fafbbf2d21408c5101c2ef.dll
Resource
win7-20240419-en
4 signatures
150 seconds
General
-
Target
95cceb588397fa999160ce70c697f40f28a594ebf3fafbbf2d21408c5101c2ef.dll
-
Size
899KB
-
MD5
2a8d593686a96840ae7fee65e4c74a80
-
SHA1
bd14e4341c6a6026c1dbf8b7d07fb49968c789e8
-
SHA256
95cceb588397fa999160ce70c697f40f28a594ebf3fafbbf2d21408c5101c2ef
-
SHA512
1162d97693676c8875e5dcf4e06abe10aa55bfb869deb69c2bdfd50b628b5e73aff1958f7425a5091dd475ce100376a89e115c8f1f64a963147136e79aa1d4f0
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXw:7wqd87Vw
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2380-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2380 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2380 2164 rundll32.exe 28 PID 2164 wrote to memory of 2380 2164 rundll32.exe 28 PID 2164 wrote to memory of 2380 2164 rundll32.exe 28 PID 2164 wrote to memory of 2380 2164 rundll32.exe 28 PID 2164 wrote to memory of 2380 2164 rundll32.exe 28 PID 2164 wrote to memory of 2380 2164 rundll32.exe 28 PID 2164 wrote to memory of 2380 2164 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\95cceb588397fa999160ce70c697f40f28a594ebf3fafbbf2d21408c5101c2ef.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\95cceb588397fa999160ce70c697f40f28a594ebf3fafbbf2d21408c5101c2ef.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2380
-