Analysis
- max time kernel
143s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
27/08/2023, 15:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf34ebafeca49968aa86c9afa035a9218a17da82c2940acc3017d552b322a4bf.exe
Resource
win7-20230712-en
windows7-x64
16 signatures
150 seconds
General
- Target bf34ebafeca49968aa86c9afa035a9218a17da82c2940acc3017d552b322a4bf.exe
- Size 1.3MB
- Sample230827-strmsaah43
- SHA256 bf34ebafeca49968aa86c9afa035a9218a17da82c2940acc3017d552b322a4bf
- MD5 c88b70d4e8a84034ad194860f3d7b232
- SHA1 d320e770dd5368f6cb9aa78c897e6515ee0c789e
- SHA512 f53a5b5072a7e7cc662adbe30a6d043aec42eb7aa25efaeb3b596482231eaeb20bc5baa1a8c91f2bbfef6d43509af4404b505464a399b9e74674ebdbcef868a2
- SSDEEP 24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMN9:QHPkVOBTK
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2276-0-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral2/memory/3740-11-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral2/memory/1000-18-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit - Gh0st RAT payload 3 IoCs
resource yara_rule behavioral2/memory/2276-0-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral2/memory/3740-11-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral2/memory/1000-18-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys sainbox.exe - Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" sainbox.exe - Executes dropped EXE 2 IoCs
pid Process 3740 sainbox.exe 1000 sainbox.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: sainbox.exe File opened (read-only) \??\O: sainbox.exe File opened (read-only) \??\P: sainbox.exe File opened (read-only) \??\R: sainbox.exe File opened (read-only) \??\S: sainbox.exe File opened (read-only) \??\U: sainbox.exe File opened (read-only) \??\Z: sainbox.exe File opened (read-only) \??\J: sainbox.exe File opened (read-only) \??\E: sainbox.exe File opened (read-only) \??\L: sainbox.exe File opened (read-only) \??\N: sainbox.exe File opened (read-only) \??\V: sainbox.exe File opened (read-only) \??\Y: sainbox.exe File opened (read-only) \??\B: sainbox.exe File opened (read-only) \??\G: sainbox.exe File opened (read-only) \??\H: sainbox.exe File opened (read-only) \??\I: sainbox.exe File opened (read-only) \??\K: sainbox.exe File opened (read-only) \??\Q: sainbox.exe File opened (read-only) \??\T: sainbox.exe File opened (read-only) \??\W: sainbox.exe File opened (read-only) \??\X: sainbox.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\sainbox.exe bf34ebafeca49968aa86c9afa035a9218a17da82c2940acc3017d552b322a4bf.exe File created C:\Windows\SysWOW64\sainbox.exe bf34ebafeca49968aa86c9afa035a9218a17da82c2940acc3017d552b322a4bf.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" sainbox.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum sainbox.exe Key created \REGISTRY\USER\.DEFAULT\Software sainbox.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft sainbox.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie sainbox.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 220 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe 1000 sainbox.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1000 sainbox.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2276 bf34ebafeca49968aa86c9afa035a9218a17da82c2940acc3017d552b322a4bf.exe Token: SeLoadDriverPrivilege 1000 sainbox.exe Token: 33 1000 sainbox.exe Token: SeIncBasePriorityPrivilege 1000 sainbox.exe Token: 33 1000 sainbox.exe Token: SeIncBasePriorityPrivilege 1000 sainbox.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2276 wrote to memory of 4028 2276 bf34ebafeca49968aa86c9afa035a9218a17da82c2940acc3017d552b322a4bf.exe 82 PID 2276 wrote to memory of 4028 2276 bf34ebafeca49968aa86c9afa035a9218a17da82c2940acc3017d552b322a4bf.exe 82 PID 2276 wrote to memory of 4028 2276 bf34ebafeca49968aa86c9afa035a9218a17da82c2940acc3017d552b322a4bf.exe 82 PID 3740 wrote to memory of 1000 3740 sainbox.exe 83 PID 3740 wrote to memory of 1000 3740 sainbox.exe 83 PID 3740 wrote to memory of 1000 3740 sainbox.exe 83 PID 4028 wrote to memory of 220 4028 cmd.exe 85 PID 4028 wrote to memory of 220 4028 cmd.exe 85 PID 4028 wrote to memory of 220 4028 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf34ebafeca49968aa86c9afa035a9218a17da82c2940acc3017d552b322a4bf.exe"C:\Users\Admin\AppData\Local\Temp\bf34ebafeca49968aa86c9afa035a9218a17da82c2940acc3017d552b322a4bf.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\BF34EB~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:220
-
-
-
C:\Windows\SysWOW64\sainbox.exeC:\Windows\SysWOW64\sainbox.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\sainbox.exeC:\Windows\SysWOW64\sainbox.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\sainbox.exe
- Size 4.3MB
- SHA256 284c3003debfa66aff87ec2aedc4ff1d9e860754d78108ccc7f66f85d77a08dd
- MD5 5e2ff0443a9d2b561c00173e70e71355
- SHA1 769c7113ec0f6c49a21abf8007fd297c51fc2ae3
- SHA512 92e4a8d41532513a79e299cb17737b6fa1f3f1eb34ff9e6995facc9da8053ad73ff8d709ae3c541410e02cb32b4e8617d5d791bed7ca897deec679a8decf6b1b
- SSDEEP 24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMN9I:QHPkVOBTKm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sainbox.exe
- Size 4.3MB
- SHA256 284c3003debfa66aff87ec2aedc4ff1d9e860754d78108ccc7f66f85d77a08dd
- MD5 5e2ff0443a9d2b561c00173e70e71355
- SHA1 769c7113ec0f6c49a21abf8007fd297c51fc2ae3
- SHA512 92e4a8d41532513a79e299cb17737b6fa1f3f1eb34ff9e6995facc9da8053ad73ff8d709ae3c541410e02cb32b4e8617d5d791bed7ca897deec679a8decf6b1b
- SSDEEP 24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMN9I:QHPkVOBTKm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sainbox.exe
- Size 4.3MB
- SHA256 284c3003debfa66aff87ec2aedc4ff1d9e860754d78108ccc7f66f85d77a08dd
- MD5 5e2ff0443a9d2b561c00173e70e71355
- SHA1 769c7113ec0f6c49a21abf8007fd297c51fc2ae3
- SHA512 92e4a8d41532513a79e299cb17737b6fa1f3f1eb34ff9e6995facc9da8053ad73ff8d709ae3c541410e02cb32b4e8617d5d791bed7ca897deec679a8decf6b1b
- SSDEEP 24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMN9I:QHPkVOBTKm
- MD5 SHA1 SHA512 SSDEEP