Resubmissions
21-04-2023 15:37
230421-s2g4baad2z 10Analysis
-
max time kernel
25s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21-04-2023 15:37
Static task
static1
Behavioral task
behavioral1
Sample
40ac2a5a4ea898a9b4b7009062c63b15.exe
Resource
win7-20230220-en
General
-
Target
40ac2a5a4ea898a9b4b7009062c63b15.exe
-
Size
1.6MB
-
MD5
40ac2a5a4ea898a9b4b7009062c63b15
-
SHA1
6cb2de3ac7ec7efc7e8483ecf0e015b9c2819421
-
SHA256
9793003669bcb9826d31c8dbb1c2d51097f661540d01ff8fffeb30ae1332a3c0
-
SHA512
03908bedfee4ecf0e4a56ba9d40e657569bd3240a798d2d74e316236ab027fed791640915e8d72f49680301c08546af3b10ce05533196da28e4473da80708a3c
-
SSDEEP
24576:ErJ+YtE0c1dxUnh+rgERYIeUUVJH7pbFnGIvaBnpL:+tY1e+rzRYjUUZ
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1556-54-0x0000000010000000-0x0000000010191000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1556-54-0x0000000010000000-0x0000000010191000-memory.dmp family_gh0strat -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
40ac2a5a4ea898a9b4b7009062c63b15.exedescription ioc process File opened (read-only) \??\L: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\N: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\S: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\U: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\Y: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\R: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\X: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\B: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\E: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\F: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\H: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\J: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\K: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\Q: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\T: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\V: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\W: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\G: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\I: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\M: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\O: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\P: 40ac2a5a4ea898a9b4b7009062c63b15.exe File opened (read-only) \??\Z: 40ac2a5a4ea898a9b4b7009062c63b15.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
40ac2a5a4ea898a9b4b7009062c63b15.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 40ac2a5a4ea898a9b4b7009062c63b15.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 40ac2a5a4ea898a9b4b7009062c63b15.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
40ac2a5a4ea898a9b4b7009062c63b15.exepid process 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
40ac2a5a4ea898a9b4b7009062c63b15.exepid process 1556 40ac2a5a4ea898a9b4b7009062c63b15.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40ac2a5a4ea898a9b4b7009062c63b15.exe"C:\Users\Admin\AppData\Local\Temp\40ac2a5a4ea898a9b4b7009062c63b15.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1556-54-0x0000000010000000-0x0000000010191000-memory.dmpFilesize
1.6MB