Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
26-03-2023 06:05
Static task
static1
Behavioral task
behavioral1
Sample
image_2023-03-25_15-34-35.png.virus.exe
Resource
win7-20230220-en
General
-
Target
image_2023-03-25_15-34-35.png.virus.exe
-
Size
1.5MB
-
MD5
304f1fe84d21240f53265556f3e7aec1
-
SHA1
ba0b6b5b2b95316e64e9ff0707d05aba07f614c5
-
SHA256
445823ec2a16daeee6bab7018eb8e940d196d32e1e658745dabe925ccb9e2529
-
SHA512
d63606f4c2c0aac50ad8bd9bc096262f425bfb929dd4358156ec1bc497c80d0251c9595f77781b1dfd4b3c0c971bdbea0a190512db896e499a1a04974682a620
-
SSDEEP
24576:fLM4cWyTOI+rDsjmWs4V6NB+HMSu+O8MYehJsjLvYikHHJkSj+Z9X6DciYamKgFY:fLM4c3TOtrDsKivuwMhJKvrmHJcpSPYU
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1520-4839-0x0000000000400000-0x0000000000625000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1520-4839-0x0000000000400000-0x0000000000625000-memory.dmp family_gh0strat -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
image_2023-03-25_15-34-35.png.virus.exedescription ioc process File opened (read-only) \??\Z: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\E: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\K: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\N: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\P: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\S: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\X: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\B: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\I: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\J: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\O: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\T: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\Y: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\H: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\M: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\R: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\U: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\V: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\W: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\F: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\G: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\L: image_2023-03-25_15-34-35.png.virus.exe File opened (read-only) \??\Q: image_2023-03-25_15-34-35.png.virus.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 29 IoCs
Processes:
image_2023-03-25_15-34-35.png.virus.exepid process 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
image_2023-03-25_15-34-35.png.virus.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 image_2023-03-25_15-34-35.png.virus.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz image_2023-03-25_15-34-35.png.virus.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
image_2023-03-25_15-34-35.png.virus.exepid process 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe 1520 image_2023-03-25_15-34-35.png.virus.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
image_2023-03-25_15-34-35.png.virus.exedescription pid process Token: 33 1520 image_2023-03-25_15-34-35.png.virus.exe Token: SeIncBasePriorityPrivilege 1520 image_2023-03-25_15-34-35.png.virus.exe Token: 33 1520 image_2023-03-25_15-34-35.png.virus.exe Token: SeIncBasePriorityPrivilege 1520 image_2023-03-25_15-34-35.png.virus.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\image_2023-03-25_15-34-35.png.virus.exe"C:\Users\Admin\AppData\Local\Temp\image_2023-03-25_15-34-35.png.virus.exe"1⤵
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1520-54-0x00000000765F0000-0x0000000076637000-memory.dmpFilesize
284KB
-
memory/1520-331-0x0000000000400000-0x0000000000625000-memory.dmpFilesize
2.1MB
-
memory/1520-461-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-462-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-463-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-464-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-465-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-466-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-467-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-468-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-469-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-470-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-471-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-472-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-473-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-474-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-475-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-476-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-477-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-478-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-479-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-480-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-481-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-482-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-483-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-484-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-485-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-486-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-487-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-488-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-489-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-490-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-491-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-492-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-493-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-494-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-495-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-496-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-497-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-498-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-499-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-500-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-501-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-502-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-503-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-504-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-505-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-506-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-507-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-508-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-509-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-510-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-511-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-512-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-513-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-514-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-515-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-516-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-517-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-518-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-519-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-520-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-521-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-522-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-523-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-1430-0x0000000001F90000-0x0000000002090000-memory.dmpFilesize
1024KB
-
memory/1520-1431-0x0000000002140000-0x00000000022C1000-memory.dmpFilesize
1.5MB
-
memory/1520-4815-0x00000000023F0000-0x0000000002501000-memory.dmpFilesize
1.1MB
-
memory/1520-4816-0x0000000002510000-0x0000000002611000-memory.dmpFilesize
1.0MB
-
memory/1520-4828-0x0000000001F90000-0x0000000002090000-memory.dmpFilesize
1024KB
-
memory/1520-4839-0x0000000000400000-0x0000000000625000-memory.dmpFilesize
2.1MB