Analysis
- max time kernel
93s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
02/01/2025, 08:51
General
- Target Ghosty Permanent Spoofer/SafeGuard-Library.dll
- Size 12.5MB
- Sample250102-kshdqatra1
- SHA256 4e3eca4adbe0c4fede28228239dd93bb866ecd0415569ede6464d796e8d1a3a8
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Ghosty Permanent Spoofer\SafeGuard-Library.dll",#11⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3168-0-0x00007FFD30578000-0x00007FFD31240000-memory.dmp
memory/3168-1-0x00007FFD4F570000-0x00007FFD4F572000-memory.dmp
memory/3168-5-0x00007FFD4F5B0000-0x00007FFD4F5B2000-memory.dmp
memory/3168-7-0x00007FFD4F5D0000-0x00007FFD4F5D2000-memory.dmp
memory/3168-6-0x00007FFD4F5C0000-0x00007FFD4F5C2000-memory.dmp
memory/3168-4-0x00007FFD4F5A0000-0x00007FFD4F5A2000-memory.dmp
memory/3168-8-0x00007FFD4F5E0000-0x00007FFD4F5E2000-memory.dmp
memory/3168-3-0x00007FFD4F590000-0x00007FFD4F592000-memory.dmp
memory/3168-2-0x00007FFD4F580000-0x00007FFD4F582000-memory.dmp
memory/3168-12-0x00007FFD4F610000-0x00007FFD4F612000-memory.dmp
memory/3168-17-0x00007FFD4F660000-0x00007FFD4F662000-memory.dmp
memory/3168-19-0x00007FFD4F680000-0x00007FFD4F682000-memory.dmp
memory/3168-22-0x00007FFD4F6B0000-0x00007FFD4F6B2000-memory.dmp
memory/3168-21-0x00007FFD4F6A0000-0x00007FFD4F6A2000-memory.dmp
memory/3168-15-0x00007FFD4F640000-0x00007FFD4F642000-memory.dmp
memory/3168-18-0x00007FFD4F670000-0x00007FFD4F672000-memory.dmp
memory/3168-13-0x00007FFD4F620000-0x00007FFD4F622000-memory.dmp
memory/3168-16-0x00007FFD4F650000-0x00007FFD4F652000-memory.dmp
memory/3168-14-0x00007FFD4F630000-0x00007FFD4F632000-memory.dmp
memory/3168-9-0x00007FFD4F5F0000-0x00007FFD4F5F2000-memory.dmp
memory/3168-11-0x00007FFD30500000-0x00007FFD31EC5000-memory.dmp
memory/3168-10-0x00007FFD4F600000-0x00007FFD4F602000-memory.dmp
memory/3168-23-0x000001713AFE0000-0x000001713B459000-memory.dmp
memory/3168-20-0x00007FFD4F690000-0x00007FFD4F692000-memory.dmp
memory/3168-29-0x000001713AFE0000-0x000001713B459000-memory.dmp
memory/3168-32-0x00007FFD30500000-0x00007FFD31EC5000-memory.dmp
memory/3168-30-0x00007FFD30500000-0x00007FFD31EC5000-memory.dmp
memory/3168-34-0x00007FFD30578000-0x00007FFD31240000-memory.dmp
memory/3168-35-0x00007FFD30500000-0x00007FFD31EC5000-memory.dmp