Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
28/08/2023, 18:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7128580d3d4567ddc2e96c15a99582c91340495b3e4efc6d52eedd9094c1397c.exe
Resource
win7-20230712-en
5 signatures
150 seconds
General
-
Target
7128580d3d4567ddc2e96c15a99582c91340495b3e4efc6d52eedd9094c1397c.exe
-
Size
1.4MB
-
MD5
8dd7ae6334517d6fa71f79dce4099b90
-
SHA1
bda6cd7b2fed8c81dff306a60a0d8c2330989c2d
-
SHA256
7128580d3d4567ddc2e96c15a99582c91340495b3e4efc6d52eedd9094c1397c
-
SHA512
b87f390e6eaf976819a847b47196663ee63cc6e4f18f5895e93c934df5d9c15ca1b458491993ba3f5c4b5f8c5a9c08c74de81b52058ec23f8e26b3a5612f54cb
-
SSDEEP
24576:F39WaOyHutimZ9VSly2hVvHW6qMnSbTBBhBMN:598HPkVOBTK
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2332-0-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2332-0-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 2332 7128580d3d4567ddc2e96c15a99582c91340495b3e4efc6d52eedd9094c1397c.exe Token: SeIncBasePriorityPrivilege 2332 7128580d3d4567ddc2e96c15a99582c91340495b3e4efc6d52eedd9094c1397c.exe Token: 33 2332 7128580d3d4567ddc2e96c15a99582c91340495b3e4efc6d52eedd9094c1397c.exe Token: SeIncBasePriorityPrivilege 2332 7128580d3d4567ddc2e96c15a99582c91340495b3e4efc6d52eedd9094c1397c.exe