Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30-03-2023 02:38
Static task
static1
Behavioral task
behavioral1
Sample
e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe
Resource
win7-20230220-en
General
-
Target
e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe
-
Size
4.6MB
-
MD5
096ccc345415b89352ded241afc64e2b
-
SHA1
ef66e15f03195b3fd58308a97ba4380b4e3587da
-
SHA256
e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05
-
SHA512
5c68a1989d3866cc97f1b3d9a9e68f25b41a6f857f4b3b0f8388983a3b858be476d66903a4fcd2dc3960ef486888c999288a302ac50bb4d7c8ee116414b28477
-
SSDEEP
98304:4xG6Ww1+meGUOowomFbZy8VctmCmavSB6lcR4z+oStmawATRU:4JcrGUOow1k8CpO6lc6K3cYT
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1420-138-0x0000000010000000-0x0000000010041000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1420-138-0x0000000010000000-0x0000000010041000-memory.dmp family_gh0strat -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exedescription ioc process File opened (read-only) \??\U: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\V: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\W: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\Z: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\I: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\K: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\Q: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\P: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\S: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\F: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\G: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\J: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\X: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\Y: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\E: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\R: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\T: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\M: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\N: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\O: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\B: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\H: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened (read-only) \??\L: e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
Processes:
e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exepid process 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe -
Drops file in Program Files directory 2 IoCs
Processes:
e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exedescription ioc process File created C:\Program Files\MSXML 6.18\ShowdLongs.exe e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe File opened for modification C:\Program Files\MSXML 6.18\ShowdLongs.exe e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exepid process 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exedescription pid process Token: SeDebugPrivilege 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exepid process 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe 1420 e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe"C:\Users\Admin\AppData\Local\Temp\e49469e7ea6bc4a838867c6d070f888dcafd2b4f5cda90f84aee03a47538ed05.exe"1⤵
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1420-133-0x0000000000400000-0x00000000018F8000-memory.dmpFilesize
21.0MB
-
memory/1420-134-0x000000007FA70000-0x000000007FE41000-memory.dmpFilesize
3.8MB
-
memory/1420-136-0x0000000000400000-0x00000000018F8000-memory.dmpFilesize
21.0MB
-
memory/1420-137-0x0000000000400000-0x00000000018F8000-memory.dmpFilesize
21.0MB
-
memory/1420-138-0x0000000010000000-0x0000000010041000-memory.dmpFilesize
260KB
-
memory/1420-154-0x0000000000400000-0x00000000018F8000-memory.dmpFilesize
21.0MB
-
memory/1420-168-0x0000000000400000-0x00000000018F8000-memory.dmpFilesize
21.0MB
-
memory/1420-185-0x0000000000400000-0x00000000018F8000-memory.dmpFilesize
21.0MB
-
memory/1420-201-0x0000000000400000-0x00000000018F8000-memory.dmpFilesize
21.0MB
-
memory/1420-216-0x0000000000400000-0x00000000018F8000-memory.dmpFilesize
21.0MB
-
memory/1420-232-0x0000000000400000-0x00000000018F8000-memory.dmpFilesize
21.0MB
-
memory/1420-249-0x0000000000400000-0x00000000018F8000-memory.dmpFilesize
21.0MB
-
memory/1420-265-0x0000000000400000-0x00000000018F8000-memory.dmpFilesize
21.0MB
-
memory/1420-278-0x0000000000400000-0x00000000018F8000-memory.dmpFilesize
21.0MB
-
memory/1420-294-0x0000000000400000-0x00000000018F8000-memory.dmpFilesize
21.0MB
-
memory/1420-311-0x0000000000400000-0x00000000018F8000-memory.dmpFilesize
21.0MB
-
memory/1420-328-0x0000000000400000-0x00000000018F8000-memory.dmpFilesize
21.0MB