Analysis
-
max time kernel
141s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 06:48
Behavioral task
behavioral1
Sample
a680424df23cd502aa1bc2540cc26a726399801b6a403c53117f0a0cf48b6b95.dll
Resource
win7-20241010-en
General
-
Target
a680424df23cd502aa1bc2540cc26a726399801b6a403c53117f0a0cf48b6b95.dll
-
Size
899KB
-
MD5
41b0f384225c28b3774009584ae9cb28
-
SHA1
a65c1fbc67cb8084b8c6194934c3829f3addc368
-
SHA256
a680424df23cd502aa1bc2540cc26a726399801b6a403c53117f0a0cf48b6b95
-
SHA512
4f4784e658d872029003d4a52367fa636a7e78b8aa1e8269529680b7142b1858c588dbf7bb1deec399a22666ed7108ff864d8c99aeac5954fd2a95e713e70eeb
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXk:7wqd87Vk
Malware Config
Extracted
gh0strat
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2860-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Gh0strat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid process 2860 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 3012 wrote to memory of 2860 3012 rundll32.exe rundll32.exe PID 3012 wrote to memory of 2860 3012 rundll32.exe rundll32.exe PID 3012 wrote to memory of 2860 3012 rundll32.exe rundll32.exe PID 3012 wrote to memory of 2860 3012 rundll32.exe rundll32.exe PID 3012 wrote to memory of 2860 3012 rundll32.exe rundll32.exe PID 3012 wrote to memory of 2860 3012 rundll32.exe rundll32.exe PID 3012 wrote to memory of 2860 3012 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a680424df23cd502aa1bc2540cc26a726399801b6a403c53117f0a0cf48b6b95.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a680424df23cd502aa1bc2540cc26a726399801b6a403c53117f0a0cf48b6b95.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:2860
-