Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2023 15:38
Static task
static1
General
-
Target
6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe
-
Size
1.2MB
-
MD5
44f50973ac66fd83be9411d6ab53446f
-
SHA1
6660ac4bf320699b43776f0d3f96c2b1cab104d3
-
SHA256
6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297
-
SHA512
80a51ae37153d1385119ffbfe14a99032898e45369a1353d4483c8d4256cce419baca447cb025dcd7fa31a9abb0a98f281744040bdb7731b48a828441e2ef74d
-
SSDEEP
24576:uyDoTqctaY5effnW8RDsXOvvYh1BKy7ILN7qxx+HP288pu3WPs2/:uwoTpE/WwDIngzRqI8p0R2/
Malware Config
Extracted
gh0strat
192.253.237.20
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1808-136-0x0000000010000000-0x0000000010192000-memory.dmp purplefox_rootkit behavioral1/memory/1808-144-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit behavioral1/memory/1808-153-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1808-136-0x0000000010000000-0x0000000010192000-memory.dmp family_gh0strat behavioral1/memory/1808-144-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat behavioral1/memory/1808-153-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exedescription ioc process File opened (read-only) \??\B: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\E: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\G: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\H: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\L: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\M: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\Z: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\F: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\I: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\O: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\P: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\S: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\W: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\X: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\Y: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\R: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\T: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\J: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\K: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\N: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\Q: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\U: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe File opened (read-only) \??\V: 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exepid process 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe 1808 6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe"C:\Users\Admin\AppData\Local\Temp\6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1808
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1808-133-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1808-134-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1808-135-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1808-136-0x0000000010000000-0x0000000010192000-memory.dmpFilesize
1.6MB
-
memory/1808-144-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1808-153-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB