Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/01/2025, 06:53
Behavioral task
behavioral1
Sample
a2341eb57f961fef837eb21ecf9717b9c7e720f3eef210c661c2e8fb72aa8dce.dll
Resource
win7-20240903-en
General
-
Target
a2341eb57f961fef837eb21ecf9717b9c7e720f3eef210c661c2e8fb72aa8dce.dll
-
Size
50KB
-
MD5
e542f4e1511c8e7af611a4f1464b0706
-
SHA1
87d85e99ec47976006d4dbc56c14a81f3393ad60
-
SHA256
a2341eb57f961fef837eb21ecf9717b9c7e720f3eef210c661c2e8fb72aa8dce
-
SHA512
d70601e00d62bd54557639af832f9bbbd694b8b82b978ab0bb03a5e315ac4d0f14614ae628e0d641ed2513b325cc14ee2f887d00233cc23e866d89c45ccbec29
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5zJYH:W5ReWjTrW9rNPgYo1JYH
Malware Config
Extracted
gh0strat
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2068-0-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat -
Gh0strat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2068 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2068 2100 rundll32.exe 31 PID 2100 wrote to memory of 2068 2100 rundll32.exe 31 PID 2100 wrote to memory of 2068 2100 rundll32.exe 31 PID 2100 wrote to memory of 2068 2100 rundll32.exe 31 PID 2100 wrote to memory of 2068 2100 rundll32.exe 31 PID 2100 wrote to memory of 2068 2100 rundll32.exe 31 PID 2100 wrote to memory of 2068 2100 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a2341eb57f961fef837eb21ecf9717b9c7e720f3eef210c661c2e8fb72aa8dce.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a2341eb57f961fef837eb21ecf9717b9c7e720f3eef210c661c2e8fb72aa8dce.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:2068
-