Analysis
-
max time kernel
140s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250610-en -
resource tags
arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2025, 05:54
General
-
Target
13dd526bcc5196736928ecc1b3578d4620609e342d288b59db189138e57f5550.dll
-
Size
899KB
-
MD5
d4ce7957fb55d125a0719e3e5069f782
-
SHA1
0a2e7d7bf55a3b3165563040e79f485f8004f557
-
SHA256
13dd526bcc5196736928ecc1b3578d4620609e342d288b59db189138e57f5550
-
SHA512
c354f3b58ec5865de35cc4bb7faff2f4a329deb23836ce9c2b4058989688b6d68a9470e7350040769453dc0248d3e5d60058d2d88cfe97ea820c9b029f670cc6
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX7:7wqd87V7
Malware Config
Extracted
Family
gh0strat
C2
hackerinvasion.f3322.net
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/1516-0-0x0000000010000000-0x000000001014F000-memory.dmp family_gh0strat -
Gh0strat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1516 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 6048 wrote to memory of 1516 6048 rundll32.exe 86 PID 6048 wrote to memory of 1516 6048 rundll32.exe 86 PID 6048 wrote to memory of 1516 6048 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\13dd526bcc5196736928ecc1b3578d4620609e342d288b59db189138e57f5550.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\13dd526bcc5196736928ecc1b3578d4620609e342d288b59db189138e57f5550.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:1516
-