Analysis
-
max time kernel
157s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 14:36
Static task
static1
Behavioral task
behavioral1
Sample
7d147fa016e7218fcf60c76d2688a100e83fbb580f3c954d55e08d2c7b0b5a14.exe
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
General
-
Target
7d147fa016e7218fcf60c76d2688a100e83fbb580f3c954d55e08d2c7b0b5a14.exe
-
Size
621KB
-
MD5
889a73d55a0c4cd0bb02ff23a9d42332
-
SHA1
1ec554975797c91ab6d32b785623659555934d99
-
SHA256
7d147fa016e7218fcf60c76d2688a100e83fbb580f3c954d55e08d2c7b0b5a14
-
SHA512
43b6ebeee59950c69ed0e2ca4b6924cf8d7efb61e5a91cfcaa5a74c75bdd56743503de50522c11f866563177eff0e5b8772ccb81e35f79ce09a5b16d40eb1648
-
SSDEEP
12288:rLDDEEuqctaY5effnWQ7x7dJsPMR1F4fWDNo5F/oJBprSqYeJGD212mF:rLDoTqctaY5effnW8RDsXOvvYM1v
Malware Config
Extracted
Family
gh0strat
C2
121.127.249.135
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1864-138-0x0000000010000000-0x0000000010192000-memory.dmp purplefox_rootkit behavioral2/memory/1864-145-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1864-138-0x0000000010000000-0x0000000010192000-memory.dmp family_gh0strat behavioral2/memory/1864-145-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1864-133-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1864-134-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1864-136-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1864-135-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1864-137-0x00000000008E0000-0x00000000008EE000-memory.dmpFilesize
56KB
-
memory/1864-138-0x0000000010000000-0x0000000010192000-memory.dmpFilesize
1.6MB
-
memory/1864-145-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1864-146-0x00000000008E0000-0x00000000008EE000-memory.dmpFilesize
56KB