Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2023 06:13
Static task
static1
Behavioral task
behavioral1
Sample
29d9a7e9c97682c4b36ccb8461b79778.exe
Resource
win7-20230220-en
windows7-x64
7 signatures
150 seconds
General
-
Target
29d9a7e9c97682c4b36ccb8461b79778.exe
-
Size
621KB
-
MD5
29d9a7e9c97682c4b36ccb8461b79778
-
SHA1
f81ef8366277be06c625c09316b39b4165b659f2
-
SHA256
71a0f84fc97d3ea8ecdc9dc19e058fe994e3cecf826f3db462c4995d8ee6dacb
-
SHA512
9a8794a3a561cf7098582a38b903d8a096b135f1a787945c0b86ed7376fad89f52b27c4548e883c23e13a71c620c78372f019016f3b8efe50792f31b86073206
-
SSDEEP
12288:PzDDEEuqctaY5effnWQ7x7dJsPMR1F4fWDNo5F/oJBprSqYeJGDh12j:PzDoTqctaY5effnW8RDsXOvvYD1a
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4268-137-0x0000000010000000-0x0000000010192000-memory.dmp purplefox_rootkit behavioral2/memory/4268-145-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/memory/4268-137-0x0000000010000000-0x0000000010192000-memory.dmp family_gh0strat behavioral2/memory/4268-145-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\E: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\K: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\Q: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\Y: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\T: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\V: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\W: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\I: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\J: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\M: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\O: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\P: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\R: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\S: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\U: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\F: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\G: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\H: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\L: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\N: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\X: 29d9a7e9c97682c4b36ccb8461b79778.exe File opened (read-only) \??\Z: 29d9a7e9c97682c4b36ccb8461b79778.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 29d9a7e9c97682c4b36ccb8461b79778.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 29d9a7e9c97682c4b36ccb8461b79778.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe 4268 29d9a7e9c97682c4b36ccb8461b79778.exe