Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2023 19:49
Static task
static1
Behavioral task
behavioral1
Sample
087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7.exe
Resource
win7-20230220-en
General
-
Target
087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7.exe
-
Size
24KB
-
MD5
bd08bf688aa1a6d46c1675b57110dd7b
-
SHA1
27ace7f22287839bf704f40581e18563b3ae7038
-
SHA256
087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7
-
SHA512
5666dec348b4dfae38b00cfd03fb4bef0824d5c0bdc7d87095bf1d777194f279c2b369356f4560dce40f5080322db7e96c12b095c59a1791f48ca9d6268b41f9
-
SSDEEP
192:h0lkFwtXjJQoOLqeCamZWRmqyRmgP1oyn0wW0//093j5ZG/XNTMfNWnxcc:5StXlQoCqCk1qwr096/XNTMfNWnxj
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/776-169-0x0000000010000000-0x0000000010191000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/776-169-0x0000000010000000-0x0000000010191000-memory.dmp family_gh0strat -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation 087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7.exe -
Executes dropped EXE 2 IoCs
Processes:
2.exetest.exepid process 776 2.exe 984 test.exe -
Drops file in System32 directory 3 IoCs
Processes:
mmc.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini mmc.exe File opened for modification C:\Windows\System32\gpedit.msc mmc.exe File opened for modification C:\Windows\System32\GroupPolicy mmc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
test.exepid process 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe 984 test.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
mmc.exepid process 4300 mmc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
mmc.exedescription pid process Token: 33 4300 mmc.exe Token: SeIncBasePriorityPrivilege 4300 mmc.exe Token: 33 4300 mmc.exe Token: SeIncBasePriorityPrivilege 4300 mmc.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7.exe2.exemmc.exepid process 1816 087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7.exe 776 2.exe 776 2.exe 4300 mmc.exe 4300 mmc.exe 4300 mmc.exe 4300 mmc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7.exetest.exedescription pid process target process PID 1816 wrote to memory of 776 1816 087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7.exe 2.exe PID 1816 wrote to memory of 776 1816 087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7.exe 2.exe PID 1816 wrote to memory of 776 1816 087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7.exe 2.exe PID 1816 wrote to memory of 984 1816 087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7.exe test.exe PID 1816 wrote to memory of 984 1816 087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7.exe test.exe PID 1816 wrote to memory of 984 1816 087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7.exe test.exe PID 984 wrote to memory of 4884 984 test.exe cmd.exe PID 984 wrote to memory of 4884 984 test.exe cmd.exe PID 984 wrote to memory of 4884 984 test.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7.exe"C:\Users\Admin\AppData\Local\Temp\087e18811cbf2011123edb351edb631da3917f65371b046e4b70137deb08d2f7.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\homo\2.exe"C:\ProgramData\homo\2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\homo\test.exe"C:\ProgramData\homo\test.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c start C:\ProgramData\1145143⤵
- Modifies registry class
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\System32\gpedit.msc"1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\homo\2.exeFilesize
1.8MB
MD50322daf8494af68b414ca24cd707d0f9
SHA1f9d329623dc471a54f98cdafc239d20cab5a06bf
SHA2566bedffa305d107e107084f21888de7bc0c6846d161949f1bb9aa61fa58d1f8de
SHA512f9cbc7843d1e56f2991ccc98e9ca2d2b857f48ed4f280ca48b96bf4e4bc4e0cde012653c8dd36d5ab2a671d652a264102b29a7086fe1d236c990d21b43b8ede2
-
C:\ProgramData\homo\2.exeFilesize
1.8MB
MD50322daf8494af68b414ca24cd707d0f9
SHA1f9d329623dc471a54f98cdafc239d20cab5a06bf
SHA2566bedffa305d107e107084f21888de7bc0c6846d161949f1bb9aa61fa58d1f8de
SHA512f9cbc7843d1e56f2991ccc98e9ca2d2b857f48ed4f280ca48b96bf4e4bc4e0cde012653c8dd36d5ab2a671d652a264102b29a7086fe1d236c990d21b43b8ede2
-
C:\ProgramData\homo\2.exeFilesize
1.8MB
MD50322daf8494af68b414ca24cd707d0f9
SHA1f9d329623dc471a54f98cdafc239d20cab5a06bf
SHA2566bedffa305d107e107084f21888de7bc0c6846d161949f1bb9aa61fa58d1f8de
SHA512f9cbc7843d1e56f2991ccc98e9ca2d2b857f48ed4f280ca48b96bf4e4bc4e0cde012653c8dd36d5ab2a671d652a264102b29a7086fe1d236c990d21b43b8ede2
-
C:\ProgramData\homo\test.exeFilesize
194KB
MD551952555d3ecfd945774f0eec76b4089
SHA1a834c93370c730cdec27e7b0cb60384c19635eb6
SHA256fd765b9af9198ea8487d849d433806a29f2cffcd8a0b5bf841a129cda9d312dd
SHA51235f58225f72b62eabb00018f4bf7786b35b87578e8101736d7f5b3352cd54a377e6859cf39d65c811e1a2ffa36a84c91a2a9211e67ae991ba084f71b85ae8993
-
C:\ProgramData\homo\test.exeFilesize
194KB
MD551952555d3ecfd945774f0eec76b4089
SHA1a834c93370c730cdec27e7b0cb60384c19635eb6
SHA256fd765b9af9198ea8487d849d433806a29f2cffcd8a0b5bf841a129cda9d312dd
SHA51235f58225f72b62eabb00018f4bf7786b35b87578e8101736d7f5b3352cd54a377e6859cf39d65c811e1a2ffa36a84c91a2a9211e67ae991ba084f71b85ae8993
-
C:\ProgramData\homo\test.exeFilesize
194KB
MD551952555d3ecfd945774f0eec76b4089
SHA1a834c93370c730cdec27e7b0cb60384c19635eb6
SHA256fd765b9af9198ea8487d849d433806a29f2cffcd8a0b5bf841a129cda9d312dd
SHA51235f58225f72b62eabb00018f4bf7786b35b87578e8101736d7f5b3352cd54a377e6859cf39d65c811e1a2ffa36a84c91a2a9211e67ae991ba084f71b85ae8993
-
memory/776-169-0x0000000010000000-0x0000000010191000-memory.dmpFilesize
1.6MB