Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 22:00
Behavioral task
behavioral1
Sample
5e7a216dfc75efff3fc37c71fb8565c1d62c3bdd41ccf1faef34a523b23f9c72.dll
Resource
win7-20240903-en
General
-
Target
5e7a216dfc75efff3fc37c71fb8565c1d62c3bdd41ccf1faef34a523b23f9c72.dll
-
Size
899KB
-
MD5
d9408c95218bca5d39425762bf5c8e2e
-
SHA1
fd32f807331a811119d3579c1e629ec091792d9c
-
SHA256
5e7a216dfc75efff3fc37c71fb8565c1d62c3bdd41ccf1faef34a523b23f9c72
-
SHA512
fb0bd1b06d13d44ce779b0a7e7a12f2012e6453c9e9fa763495c6661d919c84bfa74e5dfca7927ee3315c7ebfa785b0ec3b55757467288ccc1478912bd368736
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXO:7wqd87VO
Malware Config
Extracted
gh0strat
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4640-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Gh0strat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 4640 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3640 wrote to memory of 4640 3640 rundll32.exe rundll32.exe PID 3640 wrote to memory of 4640 3640 rundll32.exe rundll32.exe PID 3640 wrote to memory of 4640 3640 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e7a216dfc75efff3fc37c71fb8565c1d62c3bdd41ccf1faef34a523b23f9c72.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e7a216dfc75efff3fc37c71fb8565c1d62c3bdd41ccf1faef34a523b23f9c72.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:4640
-