Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 21:43
Behavioral task
behavioral1
Sample
95cceb588397fa999160ce70c697f40f28a594ebf3fafbbf2d21408c5101c2ef.dll
Resource
win7-20240419-en
4 signatures
150 seconds
General
-
Target
95cceb588397fa999160ce70c697f40f28a594ebf3fafbbf2d21408c5101c2ef.dll
-
Size
899KB
-
MD5
2a8d593686a96840ae7fee65e4c74a80
-
SHA1
bd14e4341c6a6026c1dbf8b7d07fb49968c789e8
-
SHA256
95cceb588397fa999160ce70c697f40f28a594ebf3fafbbf2d21408c5101c2ef
-
SHA512
1162d97693676c8875e5dcf4e06abe10aa55bfb869deb69c2bdfd50b628b5e73aff1958f7425a5091dd475ce100376a89e115c8f1f64a963147136e79aa1d4f0
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXw:7wqd87Vw
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/5048-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 5048 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4836 wrote to memory of 5048 4836 rundll32.exe 89 PID 4836 wrote to memory of 5048 4836 rundll32.exe 89 PID 4836 wrote to memory of 5048 4836 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\95cceb588397fa999160ce70c697f40f28a594ebf3fafbbf2d21408c5101c2ef.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\95cceb588397fa999160ce70c697f40f28a594ebf3fafbbf2d21408c5101c2ef.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3504 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:81⤵PID:3272