Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 18:39
Behavioral task
behavioral1
Sample
e19e8ff5981aec7f5462b5cec8657c6f9c55ee0a2c4d1a2bde868996a6ff60d8.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
e19e8ff5981aec7f5462b5cec8657c6f9c55ee0a2c4d1a2bde868996a6ff60d8.dll
-
Size
51KB
-
MD5
3a6f36f59431fb65289336bf675ccef2
-
SHA1
5343b7a6f4dc87ac35c5f260fedf7594b96d5c12
-
SHA256
e19e8ff5981aec7f5462b5cec8657c6f9c55ee0a2c4d1a2bde868996a6ff60d8
-
SHA512
d7fa3a568af6128c9dc1b36fb8e06080bd51166c986feb6bdd1433d2e7f332eb0bbe04fcc8ae2a7009b99f2c1a4791ca13f39818ccaf0eb20b5b5192cc5e7e6e
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLrJYH5:1dWubF3n9S91BF3fboPJYH5
Malware Config
Extracted
Family
gh0strat
C2
kinh.xmcxmr.com
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2348-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2348 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 648 wrote to memory of 2348 648 rundll32.exe 90 PID 648 wrote to memory of 2348 648 rundll32.exe 90 PID 648 wrote to memory of 2348 648 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e19e8ff5981aec7f5462b5cec8657c6f9c55ee0a2c4d1a2bde868996a6ff60d8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e19e8ff5981aec7f5462b5cec8657c6f9c55ee0a2c4d1a2bde868996a6ff60d8.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:916