Analysis
- max time kernel
149s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 08:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
51da5cf2efbb3342e4105263041ad0d9c48d723d92982d2a9a453170bfbea0e1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 51da5cf2efbb3342e4105263041ad0d9c48d723d92982d2a9a453170bfbea0e1.dll
- Size 287KB
- Sample260825-kdaqbsfr4s
- SHA256 51da5cf2efbb3342e4105263041ad0d9c48d723d92982d2a9a453170bfbea0e1
- MD5 ccb8fda5c5fdb2e47697b41d1d29b1c7
- SHA1 6afb2175f23cd7653ed892132f3025f0cc2bcfe9
- SHA512 174d1329c26d4f1171e8dba91567ff0feb747754840d7d8a2ad732988db856b7aa0f05ad5cdc6d8064259e21ccbc83ff1a8ab13aa906c05e6d517a6d0dd4d666
- SSDEEP 6144:31bk+S3EnqGBer3KQMnsvpW7mKS/Lrht5gzyHy1UtSYD:LqGB2KQMnsvpW7+Hh3KgS
- TLSH T174542959FA0721F5E51746B58DBFE3BFC71476548222EBBBEB4FCA42B4323022845249
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Gh0st RAT payload 5 IoCs
resource yara_rule behavioral2/memory/3236-8-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat behavioral2/memory/3236-10-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat behavioral2/memory/5232-20-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat behavioral2/memory/5232-17-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat behavioral2/memory/5232-22-0x0000000010000000-0x0000000010011000-memory.dmp family_gh0strat - Badlisted process makes network request 13 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 1 3236 rundll32.exe 2 3236 rundll32.exe 3 5232 cmd.exe 4 5232 cmd.exe 5 5232 cmd.exe 6 5232 cmd.exe 7 5232 cmd.exe 8 5232 cmd.exe 9 5232 cmd.exe 10 5232 cmd.exe 11 5232 cmd.exe 12 5232 cmd.exe 13 5232 cmd.exe -
resource yara_rule behavioral2/memory/3236-8-0x0000000010000000-0x0000000010011000-memory.dmp upx behavioral2/memory/3236-5-0x0000000010000000-0x0000000010011000-memory.dmp upx behavioral2/memory/3236-10-0x0000000010000000-0x0000000010011000-memory.dmp upx behavioral2/memory/5232-14-0x0000000010000000-0x0000000010011000-memory.dmp upx behavioral2/memory/5232-20-0x0000000010000000-0x0000000010011000-memory.dmp upx behavioral2/memory/5232-17-0x0000000010000000-0x0000000010011000-memory.dmp upx behavioral2/memory/5232-22-0x0000000010000000-0x0000000010011000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe 5232 cmd.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4864 wrote to memory of 3236 4864 rundll32.exe 88 PID 3236 wrote to memory of 5232 3236 rundll32.exe 89 PID 3236 wrote to memory of 5232 3236 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\51da5cf2efbb3342e4105263041ad0d9c48d723d92982d2a9a453170bfbea0e1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\51da5cf2efbb3342e4105263041ad0d9c48d723d92982d2a9a453170bfbea0e1.dll,#12⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe -Puppet3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5232
-
-