Analysis
-
max time kernel
30s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
31-05-2023 10:12
Static task
static1
Behavioral task
behavioral1
Sample
08f86429b9cd43cfeb4379418e5350f8.exe
Resource
win7-20230220-en
General
-
Target
08f86429b9cd43cfeb4379418e5350f8.exe
-
Size
1.3MB
-
MD5
08f86429b9cd43cfeb4379418e5350f8
-
SHA1
15965da0b459d890e8ef0186bef97afb9301718e
-
SHA256
5d01444b146fdcd099631627115f1bded3269fec422a6a691604e7e6279817a2
-
SHA512
bd97155343429e81873bf4058bb24343600c34a710e6ce32baa0acd0a0ff34949b40a8741060e48d756f0a90cda959b25eff8492ab886c07853c494725eb2f0d
-
SSDEEP
24576:W7qhfbYtE0c1dxUnh+rgERYIeUUVJH7pb8zI8:W7qhfctY1e+rzRYjUUZIV
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/844-54-0x0000000010000000-0x0000000010191000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/844-54-0x0000000010000000-0x0000000010191000-memory.dmp family_gh0strat -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
08f86429b9cd43cfeb4379418e5350f8.exedescription ioc process File opened (read-only) \??\B: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\E: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\P: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\U: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\T: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\X: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\F: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\K: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\L: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\S: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\W: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\Y: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\H: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\J: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\Q: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\R: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\O: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\V: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\Z: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\G: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\I: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\M: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\N: 08f86429b9cd43cfeb4379418e5350f8.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
08f86429b9cd43cfeb4379418e5350f8.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 08f86429b9cd43cfeb4379418e5350f8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 08f86429b9cd43cfeb4379418e5350f8.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
08f86429b9cd43cfeb4379418e5350f8.exepid process 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
08f86429b9cd43cfeb4379418e5350f8.exepid process 844 08f86429b9cd43cfeb4379418e5350f8.exe 844 08f86429b9cd43cfeb4379418e5350f8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08f86429b9cd43cfeb4379418e5350f8.exe"C:\Users\Admin\AppData\Local\Temp\08f86429b9cd43cfeb4379418e5350f8.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/844-54-0x0000000010000000-0x0000000010191000-memory.dmpFilesize
1.6MB