Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 15:02
Static task
static1
General
-
Target
7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe
-
Size
1.2MB
-
MD5
9d74be377a228c15764fa4c667876d46
-
SHA1
897e331a6d8e7bc6b745cdb25bb6d9b07c6661f2
-
SHA256
7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b
-
SHA512
186b696dd92ef14071813c1238d4ed828d6f107bec972dd4b99d7e1346c5cba4ba7572615e5f8c689a887f62b7674fb2d1f17766a9c62356c0d4d917cc09d457
-
SSDEEP
24576:4nDoTqctaY5effnW8RDsXOvvYN12x8mp9GG9pM8hyWsSCk8HfY8n5:4DoTpE/WwDIr2xnGG9pMwyRf3
Malware Config
Extracted
gh0strat
103.39.210.206
Signatures
-
Processes:
resource yara_rule behavioral1/memory/4592-137-0x0000000010000000-0x0000000010192000-memory.dmp purplefox_rootkit behavioral1/memory/4592-146-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4592-137-0x0000000010000000-0x0000000010192000-memory.dmp family_gh0strat behavioral1/memory/4592-146-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exedescription ioc process File opened (read-only) \??\N: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\R: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\T: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\V: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\B: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\P: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\W: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\O: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\Y: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\E: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\F: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\K: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\M: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\L: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\Q: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\S: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\U: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\G: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\H: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\I: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\J: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\X: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe File opened (read-only) \??\Z: 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exepid process 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe 4592 7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe"C:\Users\Admin\AppData\Local\Temp\7e2ac120ba9883a9e9d6f629152f268f0f0abc01639669b4636feecf74b2681b.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4592
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4592-133-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/4592-134-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/4592-135-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/4592-136-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/4592-137-0x0000000010000000-0x0000000010192000-memory.dmpFilesize
1.6MB
-
memory/4592-144-0x0000000000800000-0x000000000080E000-memory.dmpFilesize
56KB
-
memory/4592-146-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/4592-147-0x0000000000800000-0x000000000080E000-memory.dmpFilesize
56KB