Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02-04-2023 01:48
Static task
static1
Behavioral task
behavioral1
Sample
cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe
Resource
win7-20230220-en
General
-
Target
cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe
-
Size
4.6MB
-
MD5
9665de160f7695ba54117e9e3619564c
-
SHA1
7b49f7051f16188b14bf073c8e770ebbd005bdea
-
SHA256
cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece
-
SHA512
5e035593ca524999b4b8dd275d754ef52f38de24c251699ed5179f2fcf5c12e7a92e1aea67bc52d22954c324afec786c894643b5a1dd7f0f2bc331c3fe32968b
-
SSDEEP
98304:3i/XDlaVlI4AhZ67RlXoAfZROOxbK58+FrzpxsUGqbgtXOgTM1/0oKU:3KD0m4A67DXfqOZ+8IIUGqbI+gw/h
Malware Config
Extracted
gh0strat
190.92.242.47
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1148-56-0x0000000010000000-0x0000000010192000-memory.dmp purplefox_rootkit behavioral1/memory/1148-62-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit behavioral1/memory/1148-66-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit behavioral1/memory/1148-72-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit behavioral1/memory/1148-75-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1148-56-0x0000000010000000-0x0000000010192000-memory.dmp family_gh0strat behavioral1/memory/1148-62-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat behavioral1/memory/1148-66-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat behavioral1/memory/1148-72-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat behavioral1/memory/1148-75-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exedescription ioc process File opened (read-only) \??\H: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\I: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\K: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\O: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\P: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\R: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\E: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\F: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\V: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\X: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\W: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\Y: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\Z: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\J: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\M: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\N: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\Q: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\U: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\B: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\G: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\T: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\L: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\S: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exepid process 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 1148 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe"C:\Users\Admin\AppData\Local\Temp\cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1148
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1148-54-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1148-56-0x0000000010000000-0x0000000010192000-memory.dmpFilesize
1.6MB
-
memory/1148-62-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1148-64-0x0000000000270000-0x000000000027B000-memory.dmpFilesize
44KB
-
memory/1148-66-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1148-72-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1148-75-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB