Analysis
-
max time kernel
141s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-11-2024 02:03
Behavioral task
behavioral1
Sample
54042b1e09db3eaeec9d1b6d14dc892e61bef44138f446ed188c51a754633bd6.dll
Resource
win7-20240903-en
General
-
Target
54042b1e09db3eaeec9d1b6d14dc892e61bef44138f446ed188c51a754633bd6.dll
-
Size
899KB
-
MD5
3fb506319d90cf477deeeac5e6c2a6d0
-
SHA1
5e6c2d104557d045d732157c9f80f89ba865b0a4
-
SHA256
54042b1e09db3eaeec9d1b6d14dc892e61bef44138f446ed188c51a754633bd6
-
SHA512
cdf73f1c08a595adb042b03d136ac4e2f3cb428e7e56033059a434f32ebb5072dadc87dc7e00f9be8649bdd998a5ce9db20537b0d63f6dea34ac46d973d40aa3
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXx:7wqd87Vx
Malware Config
Extracted
gh0strat
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2632-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Gh0strat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid Process 2632 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 2236 wrote to memory of 2632 2236 rundll32.exe 30 PID 2236 wrote to memory of 2632 2236 rundll32.exe 30 PID 2236 wrote to memory of 2632 2236 rundll32.exe 30 PID 2236 wrote to memory of 2632 2236 rundll32.exe 30 PID 2236 wrote to memory of 2632 2236 rundll32.exe 30 PID 2236 wrote to memory of 2632 2236 rundll32.exe 30 PID 2236 wrote to memory of 2632 2236 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\54042b1e09db3eaeec9d1b6d14dc892e61bef44138f446ed188c51a754633bd6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\54042b1e09db3eaeec9d1b6d14dc892e61bef44138f446ed188c51a754633bd6.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:2632
-