Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
22/08/2023, 23:49
Static task
static1
Behavioral task
behavioral1
Sample
a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe
Resource
win7-20230712-en
General
-
Target
a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe
-
Size
1.3MB
-
MD5
77067942cb7b5515dada10fcba8a34ac
-
SHA1
580b6cc3a37bd19081ffe8885dbc5613fb74a24f
-
SHA256
a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e
-
SHA512
08829b2f5d94cfb9335df65fe38aa45fc5e8b39e26dc31f35f635956906f678960ba87a7b5f17fd6df0a3ece3efe809247638c20c2fbfd495c8b180d7d42e5f6
-
SSDEEP
24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNF:QHPkVOBTK
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2636-53-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral1/memory/2584-70-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/memory/2636-53-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral1/memory/2584-70-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys sainbox.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" sainbox.exe -
Deletes itself 1 IoCs
pid Process 2568 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 1716 sainbox.exe 2584 sainbox.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\sainbox.exe a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe File opened for modification C:\Windows\SysWOW64\sainbox.exe a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2792 PING.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2584 sainbox.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2636 a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe Token: SeLoadDriverPrivilege 2584 sainbox.exe Token: 33 2584 sainbox.exe Token: SeIncBasePriorityPrivilege 2584 sainbox.exe Token: 33 2584 sainbox.exe Token: SeIncBasePriorityPrivilege 2584 sainbox.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2568 2636 a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe 29 PID 2636 wrote to memory of 2568 2636 a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe 29 PID 2636 wrote to memory of 2568 2636 a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe 29 PID 2636 wrote to memory of 2568 2636 a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe 29 PID 1716 wrote to memory of 2584 1716 sainbox.exe 31 PID 1716 wrote to memory of 2584 1716 sainbox.exe 31 PID 1716 wrote to memory of 2584 1716 sainbox.exe 31 PID 1716 wrote to memory of 2584 1716 sainbox.exe 31 PID 2568 wrote to memory of 2792 2568 cmd.exe 32 PID 2568 wrote to memory of 2792 2568 cmd.exe 32 PID 2568 wrote to memory of 2792 2568 cmd.exe 32 PID 2568 wrote to memory of 2792 2568 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe"C:\Users\Admin\AppData\Local\Temp\a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\A4BAD7~1.EXE > nul2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:2792
-
-
-
C:\Windows\SysWOW64\sainbox.exeC:\Windows\SysWOW64\sainbox.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\sainbox.exeC:\Windows\SysWOW64\sainbox.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD577067942cb7b5515dada10fcba8a34ac
SHA1580b6cc3a37bd19081ffe8885dbc5613fb74a24f
SHA256a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e
SHA51208829b2f5d94cfb9335df65fe38aa45fc5e8b39e26dc31f35f635956906f678960ba87a7b5f17fd6df0a3ece3efe809247638c20c2fbfd495c8b180d7d42e5f6
-
Filesize
1.3MB
MD577067942cb7b5515dada10fcba8a34ac
SHA1580b6cc3a37bd19081ffe8885dbc5613fb74a24f
SHA256a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e
SHA51208829b2f5d94cfb9335df65fe38aa45fc5e8b39e26dc31f35f635956906f678960ba87a7b5f17fd6df0a3ece3efe809247638c20c2fbfd495c8b180d7d42e5f6