Analysis
-
max time kernel
138s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2023, 11:48
Static task
static1
Behavioral task
behavioral1
Sample
6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe
Resource
win7-20231023-en
windows7-x64
General
-
Target
6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe
-
Size
152KB
-
MD5
b59b8b60633f4477d0160dfaddfa6899
-
SHA1
6702a138fb55ea3e15ab8a030f499925e4f02c1d
-
SHA256
6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5
-
SHA512
f5e8e4f4a0c22a5bfb2b406f6662236e11693a1066f2e4937a8b8389d22735b683287b8d75b0eac1dc8e04667fa8864e24682065ca8944e9ae16be492b93a411
-
SSDEEP
1536:QVU7YpxuKobIY6TgTJhJh5tgpIy4TzfOMM/BQkZQA:QuoxQbIY6TgTKtr1
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2644-13-0x0000000010000000-0x0000000010199000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2644-13-0x0000000010000000-0x0000000010199000-memory.dmp family_gh0strat -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation 6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe -
Executes dropped EXE 1 IoCs
pid Process 2644 testentixhz.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: testentixhz.exe File opened (read-only) \??\Q: testentixhz.exe File opened (read-only) \??\V: testentixhz.exe File opened (read-only) \??\X: testentixhz.exe File opened (read-only) \??\P: testentixhz.exe File opened (read-only) \??\R: testentixhz.exe File opened (read-only) \??\Z: testentixhz.exe File opened (read-only) \??\B: testentixhz.exe File opened (read-only) \??\I: testentixhz.exe File opened (read-only) \??\J: testentixhz.exe File opened (read-only) \??\O: testentixhz.exe File opened (read-only) \??\N: testentixhz.exe File opened (read-only) \??\T: testentixhz.exe File opened (read-only) \??\U: testentixhz.exe File opened (read-only) \??\M: testentixhz.exe File opened (read-only) \??\S: testentixhz.exe File opened (read-only) \??\W: testentixhz.exe File opened (read-only) \??\Y: testentixhz.exe File opened (read-only) \??\G: testentixhz.exe File opened (read-only) \??\H: testentixhz.exe File opened (read-only) \??\K: testentixhz.exe File opened (read-only) \??\L: testentixhz.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\testnxhz\testentixhz.exe 6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 testentixhz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz testentixhz.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe 2644 testentixhz.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3688 6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe 3688 6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe 3688 6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe 2644 testentixhz.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3688 wrote to memory of 2644 3688 6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe 94 PID 3688 wrote to memory of 2644 3688 6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe 94 PID 3688 wrote to memory of 2644 3688 6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe"C:\Users\Admin\AppData\Local\Temp\6504d3d732a500bc1ee7cf81f2d00cefccaebed175cc1eb1df13d82d9b83e5d5.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\testnxhz\testentixhz.exe"C:\Windows\sysWOW64\testnxhz\testentixhz.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5919f40dce45adfa377ecf523ef02504c
SHA142017e9ffa6b84804e363bd3df4fe6a2ef749d20
SHA256e9638e1d96838fc163e5471a98db1a51d1495b4190a097cd02990e39d27e7971
SHA5124617508f3d59140f9243f8e65c3528f2486d3df5327266bdcc03003b00884ac21527e128aba364e42938a99f3dfc3ec112b831c683d3c7bd6b54407bb2c2343b
-
Filesize
1.3MB
MD5919f40dce45adfa377ecf523ef02504c
SHA142017e9ffa6b84804e363bd3df4fe6a2ef749d20
SHA256e9638e1d96838fc163e5471a98db1a51d1495b4190a097cd02990e39d27e7971
SHA5124617508f3d59140f9243f8e65c3528f2486d3df5327266bdcc03003b00884ac21527e128aba364e42938a99f3dfc3ec112b831c683d3c7bd6b54407bb2c2343b