Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21-03-2023 14:36
Static task
static1
Behavioral task
behavioral1
Sample
71a0f84fc97d3ea8ecdc9dc19e058fe994e3cecf826f3db462c4995d8ee6dacb.exe
Resource
win7-20230220-en
4 signatures
150 seconds
General
-
Target
71a0f84fc97d3ea8ecdc9dc19e058fe994e3cecf826f3db462c4995d8ee6dacb.exe
-
Size
621KB
-
MD5
29d9a7e9c97682c4b36ccb8461b79778
-
SHA1
f81ef8366277be06c625c09316b39b4165b659f2
-
SHA256
71a0f84fc97d3ea8ecdc9dc19e058fe994e3cecf826f3db462c4995d8ee6dacb
-
SHA512
9a8794a3a561cf7098582a38b903d8a096b135f1a787945c0b86ed7376fad89f52b27c4548e883c23e13a71c620c78372f019016f3b8efe50792f31b86073206
-
SSDEEP
12288:PzDDEEuqctaY5effnWQ7x7dJsPMR1F4fWDNo5F/oJBprSqYeJGDh12j:PzDoTqctaY5effnW8RDsXOvvYD1a
Malware Config
Extracted
Family
gh0strat
C2
202.79.173.137
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1496-56-0x0000000010000000-0x0000000010192000-memory.dmp purplefox_rootkit behavioral1/memory/1496-62-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit behavioral1/memory/1496-65-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit behavioral1/memory/1496-74-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1496-56-0x0000000010000000-0x0000000010192000-memory.dmp family_gh0strat behavioral1/memory/1496-62-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat behavioral1/memory/1496-65-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat behavioral1/memory/1496-74-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1496-54-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1496-56-0x0000000010000000-0x0000000010192000-memory.dmpFilesize
1.6MB
-
memory/1496-62-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1496-63-0x0000000000250000-0x000000000025B000-memory.dmpFilesize
44KB
-
memory/1496-65-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1496-74-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB