Analysis
- max time kernel
91s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
22/01/2024, 08:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
471b2fe37c91bb020e7907897587099e.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
General
- Target 471b2fe37c91bb020e7907897587099e.exe
- Size 1.2MB
- Sample240122-kqe6kscean
- SHA256 68abafd00ce80bf87b40ac64359794d75bedc8799e787511e6bd20f6a88295d2
- MD5 471b2fe37c91bb020e7907897587099e
- SHA1 ea6a00d337032eae6538f0baac968c27f387c10c
- SHA512 61081c241e8cfeeb11b368afe31993392f4c882e153ac38453c3029a33379cfb963d13fd1a99e4dec82e1eb2d7bebe089e636aca50ad7ba2b6118de15d8695ea
- SSDEEP 12288:zcWl26g/UBlRn5DzZ3TTP+5WkOVHK/H7sx117ksgSh20RUTMkzVSleJHcT/rBMS8:gWgHN8kSszVSlMHcTDBMGr9chBMvk
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4592-0-0x0000000010000000-0x0000000010192000-memory.dmp purplefox_rootkit - Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4592-0-0x0000000010000000-0x0000000010192000-memory.dmp family_gh0strat - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\Z: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\I: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\L: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\Q: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\J: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\K: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\B: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\E: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\G: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\U: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\X: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\Y: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\O: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\P: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\T: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\R: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\S: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\V: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\H: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\M: 471b2fe37c91bb020e7907897587099e.exe File opened (read-only) \??\N: 471b2fe37c91bb020e7907897587099e.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 471b2fe37c91bb020e7907897587099e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 471b2fe37c91bb020e7907897587099e.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe 4592 471b2fe37c91bb020e7907897587099e.exe