Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 20:53
Behavioral task
behavioral1
Sample
28684d9732197081b4d155d4b1fcd9d2a46f2d47371535212b394fff3d74f388.dll
Resource
win7-20240903-en
General
-
Target
28684d9732197081b4d155d4b1fcd9d2a46f2d47371535212b394fff3d74f388.dll
-
Size
899KB
-
MD5
0716cd9d24062721d238e9f5480698f7
-
SHA1
91611502c0db6a31c1e3094071e4d905850c9041
-
SHA256
28684d9732197081b4d155d4b1fcd9d2a46f2d47371535212b394fff3d74f388
-
SHA512
46f12ad13e390b5a754458d46b4054c8ceb7694629eba8db346db0d1c6af9e579e59fb0eab26c98dfafc3142fc6a401bdaa21f8f2619ab851b8d9ed10925ec3d
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXm:7wqd87Vm
Malware Config
Extracted
gh0strat
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2660-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Gh0strat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2660 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2660 3028 rundll32.exe 30 PID 3028 wrote to memory of 2660 3028 rundll32.exe 30 PID 3028 wrote to memory of 2660 3028 rundll32.exe 30 PID 3028 wrote to memory of 2660 3028 rundll32.exe 30 PID 3028 wrote to memory of 2660 3028 rundll32.exe 30 PID 3028 wrote to memory of 2660 3028 rundll32.exe 30 PID 3028 wrote to memory of 2660 3028 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\28684d9732197081b4d155d4b1fcd9d2a46f2d47371535212b394fff3d74f388.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\28684d9732197081b4d155d4b1fcd9d2a46f2d47371535212b394fff3d74f388.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:2660
-