Analysis
-
max time kernel
121s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
13-08-2023 10:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe
Resource
win7-20230712-en
windows7-x64
7 signatures
150 seconds
General
-
Target
dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe
-
Size
1.4MB
-
MD5
eb6fbbe18d63aef164979766989e5f27
-
SHA1
5acafcadd1f1ba55731f9a02bcf152bb697e4ad1
-
SHA256
dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7
-
SHA512
4a1e1932e4bab4510a4c3ac0c0c14c94c8f00792c35d2b4f1e4a25eaa8c37bc106ef400cf87a8f4969e8705450687a73ba16539e1578d961fbaab480cc258b6b
-
SSDEEP
24576:F39WkOyHutimZ9VSly2hVvHW6qMnSbTBBhBMN:59qHPkVOBTK
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2272-54-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2272-54-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exedescription ioc process File opened (read-only) \??\B: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\E: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\G: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\I: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\K: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\L: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\M: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\T: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\W: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\J: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\O: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\U: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\V: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\Y: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\H: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\N: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\P: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\Q: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\R: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\X: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\S: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe File opened (read-only) \??\Z: dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exepid process 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exedescription pid process Token: 33 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe Token: SeIncBasePriorityPrivilege 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe Token: 33 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe Token: SeIncBasePriorityPrivilege 2272 dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe"C:\Users\Admin\AppData\Local\Temp\dd63a0473c5ddf211ca7bb31ae868dfa8a03d4056dd84c9b813b219b33cdc5c7.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2272
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2272-54-0x0000000010000000-0x000000001019F000-memory.dmpFilesize
1.6MB