Analysis
-
max time kernel
31s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-12-2022 04:30
Static task
static1
Behavioral task
behavioral1
Sample
61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe
Resource
win7-20221111-en
General
-
Target
61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe
-
Size
2.3MB
-
MD5
5630cbc8bab9ae8c880016900504284a
-
SHA1
ad94ae9fbf49ac02793078030097632349eebfa8
-
SHA256
61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85
-
SHA512
3afbc54695dd186c39d28189450acfddd1ac80bf51e2e58a4e88dc6c294dea1bfa483edc4c21d60bf08f04ad7ad4df11b09be856d34389b227bd3a9e5c15bb52
-
SSDEEP
49152:NvyXDbhPJiugp5H3fMOMdw9bjkxiIiFYh/oc51IXa+UI5moW:NvuVQFp5PMOzQyFYh/ZnIhv5mo
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1720-61-0x0000000010000000-0x00000000101A0000-memory.dmp purplefox_rootkit behavioral1/memory/1720-65-0x0000000000400000-0x00000000005B490F-memory.dmp purplefox_rootkit behavioral1/memory/1720-80-0x0000000000400000-0x00000000005B490F-memory.dmp purplefox_rootkit behavioral1/memory/664-82-0x0000000000400000-0x00000000005B490F-memory.dmp purplefox_rootkit behavioral1/memory/1432-84-0x0000000010000000-0x00000000101A0000-memory.dmp purplefox_rootkit behavioral1/memory/1432-86-0x0000000000400000-0x00000000005B490F-memory.dmp purplefox_rootkit -
Gh0st RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1720-61-0x0000000010000000-0x00000000101A0000-memory.dmp family_gh0strat behavioral1/memory/1720-65-0x0000000000400000-0x00000000005B490F-memory.dmp family_gh0strat behavioral1/memory/1720-80-0x0000000000400000-0x00000000005B490F-memory.dmp family_gh0strat behavioral1/memory/664-82-0x0000000000400000-0x00000000005B490F-memory.dmp family_gh0strat behavioral1/memory/1432-84-0x0000000010000000-0x00000000101A0000-memory.dmp family_gh0strat behavioral1/memory/1432-86-0x0000000000400000-0x00000000005B490F-memory.dmp family_gh0strat -
Executes dropped EXE 3 IoCs
Processes:
675.exeSSkGcsk.exeSSkGcsk.exepid process 1720 675.exe 664 SSkGcsk.exe 1432 SSkGcsk.exe -
Loads dropped DLL 1 IoCs
Processes:
61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exepid process 1764 61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
SSkGcsk.exedescription ioc process File opened (read-only) \??\M: SSkGcsk.exe File opened (read-only) \??\N: SSkGcsk.exe File opened (read-only) \??\P: SSkGcsk.exe File opened (read-only) \??\Q: SSkGcsk.exe File opened (read-only) \??\Z: SSkGcsk.exe File opened (read-only) \??\B: SSkGcsk.exe File opened (read-only) \??\G: SSkGcsk.exe File opened (read-only) \??\V: SSkGcsk.exe File opened (read-only) \??\I: SSkGcsk.exe File opened (read-only) \??\K: SSkGcsk.exe File opened (read-only) \??\W: SSkGcsk.exe File opened (read-only) \??\X: SSkGcsk.exe File opened (read-only) \??\Y: SSkGcsk.exe File opened (read-only) \??\O: SSkGcsk.exe File opened (read-only) \??\R: SSkGcsk.exe File opened (read-only) \??\S: SSkGcsk.exe File opened (read-only) \??\E: SSkGcsk.exe File opened (read-only) \??\F: SSkGcsk.exe File opened (read-only) \??\H: SSkGcsk.exe File opened (read-only) \??\J: SSkGcsk.exe File opened (read-only) \??\L: SSkGcsk.exe File opened (read-only) \??\T: SSkGcsk.exe File opened (read-only) \??\U: SSkGcsk.exe -
Drops file in System32 directory 4 IoCs
Processes:
61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe675.exedescription ioc process File created C:\Windows\SysWOW64\675.exe 61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe File created C:\Windows\SysWOW64\SSkGcsk.exe 675.exe File opened for modification C:\Windows\SysWOW64\SSkGcsk.exe 675.exe File opened for modification C:\Windows\SysWOW64\675.exe 675.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exepid process 1764 61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe 1764 61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SSkGcsk.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SSkGcsk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SSkGcsk.exe -
Modifies data under HKEY_USERS 12 IoCs
Processes:
SSkGcsk.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" SSkGcsk.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 SSkGcsk.exe Key created \REGISTRY\USER\.DEFAULT\Software SSkGcsk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum SSkGcsk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie SSkGcsk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings SSkGcsk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections SSkGcsk.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 SSkGcsk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings SSkGcsk.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" SSkGcsk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum SSkGcsk.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft SSkGcsk.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
SSkGcsk.exepid process 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe 1432 SSkGcsk.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exepid process 1764 61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
675.exedescription pid process Token: SeIncBasePriorityPrivilege 1720 675.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exepid process 1764 61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe 1764 61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe 1764 61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe675.exeSSkGcsk.execmd.exedescription pid process target process PID 1764 wrote to memory of 1720 1764 61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe 675.exe PID 1764 wrote to memory of 1720 1764 61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe 675.exe PID 1764 wrote to memory of 1720 1764 61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe 675.exe PID 1764 wrote to memory of 1720 1764 61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe 675.exe PID 1720 wrote to memory of 1168 1720 675.exe cmd.exe PID 1720 wrote to memory of 1168 1720 675.exe cmd.exe PID 1720 wrote to memory of 1168 1720 675.exe cmd.exe PID 1720 wrote to memory of 1168 1720 675.exe cmd.exe PID 664 wrote to memory of 1432 664 SSkGcsk.exe SSkGcsk.exe PID 664 wrote to memory of 1432 664 SSkGcsk.exe SSkGcsk.exe PID 664 wrote to memory of 1432 664 SSkGcsk.exe SSkGcsk.exe PID 664 wrote to memory of 1432 664 SSkGcsk.exe SSkGcsk.exe PID 1168 wrote to memory of 1792 1168 cmd.exe PING.EXE PID 1168 wrote to memory of 1792 1168 cmd.exe PING.EXE PID 1168 wrote to memory of 1792 1168 cmd.exe PING.EXE PID 1168 wrote to memory of 1792 1168 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe"C:\Users\Admin\AppData\Local\Temp\61c2dd595a4b99156cb45d62dda03eedd80e4fb4cb5ed2537fe14e72485c0c85.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\675.exeC:\Windows\System32\675.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Windows\SysWOW64\675.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\SSkGcsk.exeC:\Windows\SysWOW64\SSkGcsk.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SSkGcsk.exeC:\Windows\SysWOW64\SSkGcsk.exe -acsi2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\675.exeFilesize
706KB
MD506b76d8bf89d24277e1f21de6037681f
SHA14b3fa3b2495500458ecc0eae1b40049d03d35924
SHA2562a21847b38a710e2e2079184560014c8f72183d2ba32ae2f62198ab0f5e91447
SHA51245434af995c413e5eeb56d703c5925363b916b87521deef418c3ef6fbdebaf72ef5caef10ec5dc330b438c46dd0c6be24a45c10097fdd27935749f9a9818454e
-
C:\Windows\SysWOW64\675.exeFilesize
706KB
MD506b76d8bf89d24277e1f21de6037681f
SHA14b3fa3b2495500458ecc0eae1b40049d03d35924
SHA2562a21847b38a710e2e2079184560014c8f72183d2ba32ae2f62198ab0f5e91447
SHA51245434af995c413e5eeb56d703c5925363b916b87521deef418c3ef6fbdebaf72ef5caef10ec5dc330b438c46dd0c6be24a45c10097fdd27935749f9a9818454e
-
C:\Windows\SysWOW64\SSkGcsk.exeFilesize
706KB
MD506b76d8bf89d24277e1f21de6037681f
SHA14b3fa3b2495500458ecc0eae1b40049d03d35924
SHA2562a21847b38a710e2e2079184560014c8f72183d2ba32ae2f62198ab0f5e91447
SHA51245434af995c413e5eeb56d703c5925363b916b87521deef418c3ef6fbdebaf72ef5caef10ec5dc330b438c46dd0c6be24a45c10097fdd27935749f9a9818454e
-
C:\Windows\SysWOW64\SSkGcsk.exeFilesize
706KB
MD506b76d8bf89d24277e1f21de6037681f
SHA14b3fa3b2495500458ecc0eae1b40049d03d35924
SHA2562a21847b38a710e2e2079184560014c8f72183d2ba32ae2f62198ab0f5e91447
SHA51245434af995c413e5eeb56d703c5925363b916b87521deef418c3ef6fbdebaf72ef5caef10ec5dc330b438c46dd0c6be24a45c10097fdd27935749f9a9818454e
-
C:\Windows\SysWOW64\SSkGcsk.exeFilesize
706KB
MD506b76d8bf89d24277e1f21de6037681f
SHA14b3fa3b2495500458ecc0eae1b40049d03d35924
SHA2562a21847b38a710e2e2079184560014c8f72183d2ba32ae2f62198ab0f5e91447
SHA51245434af995c413e5eeb56d703c5925363b916b87521deef418c3ef6fbdebaf72ef5caef10ec5dc330b438c46dd0c6be24a45c10097fdd27935749f9a9818454e
-
\Windows\SysWOW64\675.exeFilesize
706KB
MD506b76d8bf89d24277e1f21de6037681f
SHA14b3fa3b2495500458ecc0eae1b40049d03d35924
SHA2562a21847b38a710e2e2079184560014c8f72183d2ba32ae2f62198ab0f5e91447
SHA51245434af995c413e5eeb56d703c5925363b916b87521deef418c3ef6fbdebaf72ef5caef10ec5dc330b438c46dd0c6be24a45c10097fdd27935749f9a9818454e
-
memory/664-82-0x0000000000400000-0x00000000005B490F-memory.dmpFilesize
1.7MB
-
memory/1168-78-0x0000000000000000-mapping.dmp
-
memory/1432-86-0x0000000000400000-0x00000000005B490F-memory.dmpFilesize
1.7MB
-
memory/1432-84-0x0000000010000000-0x00000000101A0000-memory.dmpFilesize
1.6MB
-
memory/1432-79-0x0000000000000000-mapping.dmp
-
memory/1720-65-0x0000000000400000-0x00000000005B490F-memory.dmpFilesize
1.7MB
-
memory/1720-80-0x0000000000400000-0x00000000005B490F-memory.dmpFilesize
1.7MB
-
memory/1720-57-0x0000000000000000-mapping.dmp
-
memory/1720-61-0x0000000010000000-0x00000000101A0000-memory.dmpFilesize
1.6MB
-
memory/1764-54-0x00000000763D1000-0x00000000763D3000-memory.dmpFilesize
8KB
-
memory/1764-55-0x0000000000400000-0x0000000000943000-memory.dmpFilesize
5.3MB
-
memory/1764-63-0x0000000011C50000-0x0000000011E05000-memory.dmpFilesize
1.7MB
-
memory/1764-92-0x0000000000400000-0x0000000000943000-memory.dmpFilesize
5.3MB
-
memory/1792-91-0x0000000000000000-mapping.dmp