Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2023 01:48
Static task
static1
Behavioral task
behavioral1
Sample
cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe
Resource
win7-20230220-en
General
-
Target
cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe
-
Size
4.6MB
-
MD5
9665de160f7695ba54117e9e3619564c
-
SHA1
7b49f7051f16188b14bf073c8e770ebbd005bdea
-
SHA256
cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece
-
SHA512
5e035593ca524999b4b8dd275d754ef52f38de24c251699ed5179f2fcf5c12e7a92e1aea67bc52d22954c324afec786c894643b5a1dd7f0f2bc331c3fe32968b
-
SSDEEP
98304:3i/XDlaVlI4AhZ67RlXoAfZROOxbK58+FrzpxsUGqbgtXOgTM1/0oKU:3KD0m4A67DXfqOZ+8IIUGqbI+gw/h
Malware Config
Extracted
gh0strat
190.92.242.47
Signatures
-
Processes:
resource yara_rule behavioral2/memory/916-137-0x0000000010000000-0x0000000010192000-memory.dmp purplefox_rootkit behavioral2/memory/916-146-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/916-137-0x0000000010000000-0x0000000010192000-memory.dmp family_gh0strat behavioral2/memory/916-146-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exedescription ioc process File opened (read-only) \??\V: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\Y: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\B: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\E: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\J: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\N: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\G: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\O: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\P: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\Z: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\Q: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\R: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\T: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\U: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\F: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\H: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\I: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\L: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\W: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\K: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\M: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\S: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe File opened (read-only) \??\X: cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exepid process 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe 916 cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe"C:\Users\Admin\AppData\Local\Temp\cc68b5edae8acaaf394ae0b92b6199f83630b9d66ba60152f0db0aa849cb0ece.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:916
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/916-133-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/916-134-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/916-135-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/916-136-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/916-137-0x0000000010000000-0x0000000010192000-memory.dmpFilesize
1.6MB
-
memory/916-141-0x00000000008E0000-0x00000000008EE000-memory.dmpFilesize
56KB
-
memory/916-146-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/916-147-0x00000000008E0000-0x00000000008EE000-memory.dmpFilesize
56KB