Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
13-04-2023 19:13
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
1.2MB
-
MD5
44f50973ac66fd83be9411d6ab53446f
-
SHA1
6660ac4bf320699b43776f0d3f96c2b1cab104d3
-
SHA256
6a97f44c2a3d62603e7870723ee797abd5d2af53e12662f0d9e0ca3c1d82e297
-
SHA512
80a51ae37153d1385119ffbfe14a99032898e45369a1353d4483c8d4256cce419baca447cb025dcd7fa31a9abb0a98f281744040bdb7731b48a828441e2ef74d
-
SSDEEP
24576:uyDoTqctaY5effnW8RDsXOvvYh1BKy7ILN7qxx+HP288pu3WPs2/:uwoTpE/WwDIngzRqI8p0R2/
Malware Config
Extracted
Family
gh0strat
C2
192.253.237.20
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1644-56-0x0000000010000000-0x0000000010192000-memory.dmp purplefox_rootkit behavioral1/memory/1644-63-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit behavioral1/memory/1644-65-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit behavioral1/memory/1644-74-0x0000000000400000-0x000000000060E000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1644-56-0x0000000010000000-0x0000000010192000-memory.dmp family_gh0strat behavioral1/memory/1644-63-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat behavioral1/memory/1644-65-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat behavioral1/memory/1644-74-0x0000000000400000-0x000000000060E000-memory.dmp family_gh0strat
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1644-54-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1644-56-0x0000000010000000-0x0000000010192000-memory.dmpFilesize
1.6MB
-
memory/1644-63-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1644-64-0x0000000000260000-0x000000000026B000-memory.dmpFilesize
44KB
-
memory/1644-65-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB
-
memory/1644-74-0x0000000000400000-0x000000000060E000-memory.dmpFilesize
2.1MB