Analysis
-
max time kernel
140s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 15:42
Behavioral task
behavioral1
Sample
12603601eff5a1a507a770182118f2dd2326c1382f403dc6e779b9c7b9548873.dll
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
12603601eff5a1a507a770182118f2dd2326c1382f403dc6e779b9c7b9548873.dll
-
Size
899KB
-
MD5
1b5bd7373ec7d89ceec4ef3b993d546a
-
SHA1
89b465605335e0833398192f33d84cfe3fd4450d
-
SHA256
12603601eff5a1a507a770182118f2dd2326c1382f403dc6e779b9c7b9548873
-
SHA512
e89dd4bd63a1d69589face3aecb890f8980faa42b1d774af20c2ff678d16d6a0d875bf0a063ef18b87ef6d6d09d69981e66152fbbd9f11f59ebb31e2cda8464e
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXm:7wqd87Vm
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2288-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Gh0strat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2288 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2288 2272 rundll32.exe 30 PID 2272 wrote to memory of 2288 2272 rundll32.exe 30 PID 2272 wrote to memory of 2288 2272 rundll32.exe 30 PID 2272 wrote to memory of 2288 2272 rundll32.exe 30 PID 2272 wrote to memory of 2288 2272 rundll32.exe 30 PID 2272 wrote to memory of 2288 2272 rundll32.exe 30 PID 2272 wrote to memory of 2288 2272 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12603601eff5a1a507a770182118f2dd2326c1382f403dc6e779b9c7b9548873.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12603601eff5a1a507a770182118f2dd2326c1382f403dc6e779b9c7b9548873.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:2288
-