Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2023, 23:49
Static task
static1
Behavioral task
behavioral1
Sample
a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe
Resource
win7-20230712-en
General
-
Target
a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe
-
Size
1.3MB
-
MD5
77067942cb7b5515dada10fcba8a34ac
-
SHA1
580b6cc3a37bd19081ffe8885dbc5613fb74a24f
-
SHA256
a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e
-
SHA512
08829b2f5d94cfb9335df65fe38aa45fc5e8b39e26dc31f35f635956906f678960ba87a7b5f17fd6df0a3ece3efe809247638c20c2fbfd495c8b180d7d42e5f6
-
SSDEEP
24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNF:QHPkVOBTK
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2812-133-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral2/memory/2212-143-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/memory/2812-133-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral2/memory/2212-143-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys sainbox.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" sainbox.exe -
Executes dropped EXE 2 IoCs
pid Process 2212 sainbox.exe 4928 sainbox.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\sainbox.exe a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe File created C:\Windows\SysWOW64\sainbox.exe a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3420 PING.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4928 sainbox.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2812 a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe Token: SeLoadDriverPrivilege 4928 sainbox.exe Token: 33 4928 sainbox.exe Token: SeIncBasePriorityPrivilege 4928 sainbox.exe Token: 33 4928 sainbox.exe Token: SeIncBasePriorityPrivilege 4928 sainbox.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2812 wrote to memory of 4484 2812 a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe 81 PID 2812 wrote to memory of 4484 2812 a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe 81 PID 2812 wrote to memory of 4484 2812 a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe 81 PID 2212 wrote to memory of 4928 2212 sainbox.exe 82 PID 2212 wrote to memory of 4928 2212 sainbox.exe 82 PID 2212 wrote to memory of 4928 2212 sainbox.exe 82 PID 4484 wrote to memory of 3420 4484 cmd.exe 84 PID 4484 wrote to memory of 3420 4484 cmd.exe 84 PID 4484 wrote to memory of 3420 4484 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe"C:\Users\Admin\AppData\Local\Temp\a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\A4BAD7~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:3420
-
-
-
C:\Windows\SysWOW64\sainbox.exeC:\Windows\SysWOW64\sainbox.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\sainbox.exeC:\Windows\SysWOW64\sainbox.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD577067942cb7b5515dada10fcba8a34ac
SHA1580b6cc3a37bd19081ffe8885dbc5613fb74a24f
SHA256a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e
SHA51208829b2f5d94cfb9335df65fe38aa45fc5e8b39e26dc31f35f635956906f678960ba87a7b5f17fd6df0a3ece3efe809247638c20c2fbfd495c8b180d7d42e5f6
-
Filesize
1.3MB
MD577067942cb7b5515dada10fcba8a34ac
SHA1580b6cc3a37bd19081ffe8885dbc5613fb74a24f
SHA256a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e
SHA51208829b2f5d94cfb9335df65fe38aa45fc5e8b39e26dc31f35f635956906f678960ba87a7b5f17fd6df0a3ece3efe809247638c20c2fbfd495c8b180d7d42e5f6
-
Filesize
1.3MB
MD577067942cb7b5515dada10fcba8a34ac
SHA1580b6cc3a37bd19081ffe8885dbc5613fb74a24f
SHA256a4bad7812fbae76f1d1827fe6c544f4843ae7711d9053c6e49f2d8a1e03e4c0e
SHA51208829b2f5d94cfb9335df65fe38aa45fc5e8b39e26dc31f35f635956906f678960ba87a7b5f17fd6df0a3ece3efe809247638c20c2fbfd495c8b180d7d42e5f6