Analysis
-
max time kernel
45s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
31/05/2023, 10:14
Static task
static1
Behavioral task
behavioral1
Sample
08f86429b9cd43cfeb4379418e5350f8.exe
Resource
win7-20230220-en
windows7-x64
8 signatures
150 seconds
General
-
Target
08f86429b9cd43cfeb4379418e5350f8.exe
-
Size
1.3MB
-
MD5
08f86429b9cd43cfeb4379418e5350f8
-
SHA1
15965da0b459d890e8ef0186bef97afb9301718e
-
SHA256
5d01444b146fdcd099631627115f1bded3269fec422a6a691604e7e6279817a2
-
SHA512
bd97155343429e81873bf4058bb24343600c34a710e6ce32baa0acd0a0ff34949b40a8741060e48d756f0a90cda959b25eff8492ab886c07853c494725eb2f0d
-
SSDEEP
24576:W7qhfbYtE0c1dxUnh+rgERYIeUUVJH7pb8zI8:W7qhfctY1e+rzRYjUUZIV
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1056-54-0x0000000010000000-0x0000000010191000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/1056-54-0x0000000010000000-0x0000000010191000-memory.dmp family_gh0strat -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\S: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\W: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\E: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\H: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\O: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\R: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\U: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\Y: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\F: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\L: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\P: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\Q: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\T: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\V: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\X: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\Z: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\K: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\G: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\I: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\M: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\N: 08f86429b9cd43cfeb4379418e5350f8.exe File opened (read-only) \??\B: 08f86429b9cd43cfeb4379418e5350f8.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 08f86429b9cd43cfeb4379418e5350f8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 08f86429b9cd43cfeb4379418e5350f8.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1056 08f86429b9cd43cfeb4379418e5350f8.exe 1056 08f86429b9cd43cfeb4379418e5350f8.exe