Analysis
-
max time kernel
111s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27-01-2025 02:43
Behavioral task
behavioral1
Sample
9039552ae705a44a64037a1daa3cfc33c974e6642a339640469ee43a8d68fd35.dll
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
9039552ae705a44a64037a1daa3cfc33c974e6642a339640469ee43a8d68fd35.dll
-
Size
49KB
-
MD5
18cab6c6cbe079a051726bad0e5e839f
-
SHA1
1657cf4cbff1e3d36cf19b031682f8a5c699ed14
-
SHA256
9039552ae705a44a64037a1daa3cfc33c974e6642a339640469ee43a8d68fd35
-
SHA512
40258228a48d44b2e2a5ef2648428b355a26260037571af86f05fe3719356d7195ce5a57d46932e401f0208a837baad7ee47b167cce9e36d4eb3cd973a6670a0
-
SSDEEP
1536:CDwMsml26T5zBj+alf1H9jfbyqkY4ZvoDUb/gJO2JYHB9ElHSI:Cn7zBjPp1H9ovoDa/gJRJYHBWZSI
Malware Config
Extracted
Family
gh0strat
C2
cf1549064127.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/1868-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Gh0strat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1868 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3624 wrote to memory of 1868 3624 rundll32.exe 82 PID 3624 wrote to memory of 1868 3624 rundll32.exe 82 PID 3624 wrote to memory of 1868 3624 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9039552ae705a44a64037a1daa3cfc33c974e6642a339640469ee43a8d68fd35.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9039552ae705a44a64037a1daa3cfc33c974e6642a339640469ee43a8d68fd35.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:1868
-