Analysis
-
max time kernel
140s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2024 02:03
Behavioral task
behavioral1
Sample
54042b1e09db3eaeec9d1b6d14dc892e61bef44138f446ed188c51a754633bd6.dll
Resource
win7-20240903-en
General
-
Target
54042b1e09db3eaeec9d1b6d14dc892e61bef44138f446ed188c51a754633bd6.dll
-
Size
899KB
-
MD5
3fb506319d90cf477deeeac5e6c2a6d0
-
SHA1
5e6c2d104557d045d732157c9f80f89ba865b0a4
-
SHA256
54042b1e09db3eaeec9d1b6d14dc892e61bef44138f446ed188c51a754633bd6
-
SHA512
cdf73f1c08a595adb042b03d136ac4e2f3cb428e7e56033059a434f32ebb5072dadc87dc7e00f9be8649bdd998a5ce9db20537b0d63f6dea34ac46d973d40aa3
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXx:7wqd87Vx
Malware Config
Extracted
gh0strat
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3848-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Gh0strat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
rundll32.exepid Process 3848 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 4888 wrote to memory of 3848 4888 rundll32.exe 83 PID 4888 wrote to memory of 3848 4888 rundll32.exe 83 PID 4888 wrote to memory of 3848 4888 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\54042b1e09db3eaeec9d1b6d14dc892e61bef44138f446ed188c51a754633bd6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\54042b1e09db3eaeec9d1b6d14dc892e61bef44138f446ed188c51a754633bd6.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:3848
-