Analysis
-
max time kernel
148s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16-08-2023 02:28
Static task
static1
Behavioral task
behavioral1
Sample
486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe
Resource
win7-20230712-en
General
-
Target
486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe
-
Size
1.7MB
-
MD5
bfc91a8472ec3c6d7d25f86aab67ec2d
-
SHA1
9ed053e0ceee4afab8dd783d335561d0581d5f3b
-
SHA256
486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92
-
SHA512
cb9583012c661b2aacede74a5063165fdb5a934137b368ff3ddf17ccdd230ef070bea128a7303a3198c10009b1eeb2e83c75529924e1141861f40dc2795c8562
-
SSDEEP
49152:YPJGmKqmJsJ64ArytAJ+N5KvCtAuevnu5l1zW3:YP4m7mROPEvC+uevuVW3
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2252-13207-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral2/memory/2252-13224-0x0000000000400000-0x0000000000681000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2252-13207-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral2/memory/2252-13224-0x0000000000400000-0x0000000000681000-memory.dmp family_gh0strat -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exedescription ioc process File opened (read-only) \??\R: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\U: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\S: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\T: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\W: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\X: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\Z: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\E: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\G: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\H: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\Q: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\B: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\O: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\P: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\L: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\M: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\N: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\V: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\Y: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\I: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\J: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe File opened (read-only) \??\K: 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 33 IoCs
Processes:
486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exepid process 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exepid process 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exedescription pid process Token: 33 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe Token: SeIncBasePriorityPrivilege 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe Token: 33 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe Token: SeIncBasePriorityPrivilege 2252 486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe"C:\Users\Admin\AppData\Local\Temp\486a5ea78e8d8612b349d8ab6b6b45328cf4488810d15b6322c492952a1a2a92.exe"1⤵
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2252
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2252-133-0x0000000000400000-0x0000000000681000-memory.dmpFilesize
2.5MB
-
memory/2252-134-0x0000000076E30000-0x0000000077045000-memory.dmpFilesize
2.1MB
-
memory/2252-4008-0x0000000075EC0000-0x0000000076060000-memory.dmpFilesize
1.6MB
-
memory/2252-6017-0x0000000076400000-0x000000007647A000-memory.dmpFilesize
488KB
-
memory/2252-13202-0x0000000000400000-0x0000000000681000-memory.dmpFilesize
2.5MB
-
memory/2252-13203-0x0000000000400000-0x0000000000681000-memory.dmpFilesize
2.5MB
-
memory/2252-13205-0x0000000000400000-0x0000000000681000-memory.dmpFilesize
2.5MB
-
memory/2252-13206-0x0000000000400000-0x0000000000681000-memory.dmpFilesize
2.5MB
-
memory/2252-13207-0x0000000010000000-0x000000001019F000-memory.dmpFilesize
1.6MB
-
memory/2252-13224-0x0000000000400000-0x0000000000681000-memory.dmpFilesize
2.5MB