Analysis
-
max time kernel
112s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-09-2022 10:30
Behavioral task
behavioral1
Sample
8466aaaecc284c59d8bf6d4facfc57ae.exe
Resource
win7-20220812-en
General
-
Target
8466aaaecc284c59d8bf6d4facfc57ae.exe
-
Size
1.0MB
-
MD5
8466aaaecc284c59d8bf6d4facfc57ae
-
SHA1
2517dcfdbcf580058a622ae39b970598ab7e9532
-
SHA256
14e364c76ecb11ece52cf5ae57e0b132abc363a54c14a79acb11794c9cc2f2b0
-
SHA512
6631eafce0e0b26063fe92ecd853f4e4fa880c5b035ab8cc03beb21f4ec3ec4e2c4be4e1bbe806b928254cd08db8b999ef4c0db7a29f93dfafddc06218228464
-
SSDEEP
24576:OX2pnEy0W0Xw8pwTBJh0Lv/SfXysirvBLUoqZ7r78FPk:OmaW0Xw8OTzhSSfXe9LUoe8h
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4532-133-0x0000000000400000-0x00000000006A2000-memory.dmp purplefox_rootkit behavioral2/memory/4532-134-0x0000000010000000-0x0000000010192000-memory.dmp purplefox_rootkit behavioral2/memory/4532-140-0x0000000000400000-0x00000000006A2000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4532-133-0x0000000000400000-0x00000000006A2000-memory.dmp family_gh0strat behavioral2/memory/4532-134-0x0000000010000000-0x0000000010192000-memory.dmp family_gh0strat behavioral2/memory/4532-140-0x0000000000400000-0x00000000006A2000-memory.dmp family_gh0strat -
Processes:
resource yara_rule behavioral2/memory/4532-132-0x0000000000400000-0x00000000006A2000-memory.dmp vmprotect behavioral2/memory/4532-133-0x0000000000400000-0x00000000006A2000-memory.dmp vmprotect behavioral2/memory/4532-140-0x0000000000400000-0x00000000006A2000-memory.dmp vmprotect -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
8466aaaecc284c59d8bf6d4facfc57ae.exedescription ioc process File opened (read-only) \??\E: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\H: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\J: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\K: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\M: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\N: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\Q: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\B: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\Z: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\I: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\F: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\P: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\R: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\S: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\V: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\W: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\X: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\Y: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\L: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\O: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\T: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\U: 8466aaaecc284c59d8bf6d4facfc57ae.exe File opened (read-only) \??\G: 8466aaaecc284c59d8bf6d4facfc57ae.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 372 4532 WerFault.exe 8466aaaecc284c59d8bf6d4facfc57ae.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
8466aaaecc284c59d8bf6d4facfc57ae.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 8466aaaecc284c59d8bf6d4facfc57ae.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 8466aaaecc284c59d8bf6d4facfc57ae.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8466aaaecc284c59d8bf6d4facfc57ae.exepid process 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe 4532 8466aaaecc284c59d8bf6d4facfc57ae.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8466aaaecc284c59d8bf6d4facfc57ae.exe"C:\Users\Admin\AppData\Local\Temp\8466aaaecc284c59d8bf6d4facfc57ae.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 2522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4532 -ip 45321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4532-132-0x0000000000400000-0x00000000006A2000-memory.dmpFilesize
2.6MB
-
memory/4532-133-0x0000000000400000-0x00000000006A2000-memory.dmpFilesize
2.6MB
-
memory/4532-134-0x0000000010000000-0x0000000010192000-memory.dmpFilesize
1.6MB
-
memory/4532-140-0x0000000000400000-0x00000000006A2000-memory.dmpFilesize
2.6MB