Analysis

  • max time kernel
    140s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2024, 22:22 UTC

General

  • Target

    b2fb9196ad7be020ce2e6eb226b3fda653adb585205ac5891d083613a2b406f1.dll

  • Size

    51KB

  • MD5

    84f9ce07302135e8f841dcec0fc627e8

  • SHA1

    cb89a9fa718f8a823f7cdf9135e0c133d202123f

  • SHA256

    b2fb9196ad7be020ce2e6eb226b3fda653adb585205ac5891d083613a2b406f1

  • SHA512

    bcc42ac803124bfa9ebf7d2ed391377632d496a005ad28df566f8294486cda514174b3b816388b6c47fbe5fa691baee169fcdef1800fb935419a43bd50ea0889

  • SSDEEP

    1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLHJYH5:1dWubF3n9S91BF3fbo7JYH5

Score
10/10

Malware Config

Extracted

Family

gh0strat

C2

kinh.xmcxmr.com

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2fb9196ad7be020ce2e6eb226b3fda653adb585205ac5891d083613a2b406f1.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:376
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2fb9196ad7be020ce2e6eb226b3fda653adb585205ac5891d083613a2b406f1.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      PID:1768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1768-0-0x0000000010000000-0x0000000010011000-memory.dmp

    Filesize

    68KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.