Analysis
-
max time kernel
121s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe
Resource
win7-20240221-en
General
-
Target
376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe
-
Size
1.3MB
-
MD5
66acec1a55ec143bfa87f067db86ec66
-
SHA1
70ff059364d73bc75369d0d6a099dca45c79fcc5
-
SHA256
376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73
-
SHA512
b11d23b012433145b280464ab8798d57ab338a06dd78207264139551381b47c2d62609cc8d6f6bf5762e47ed18fb5e6cc244c084a1a243a31217bd6d5d34311f
-
SSDEEP
24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNN:QHPkVOBTK
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2756-0-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral1/memory/1300-12-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/memory/2756-0-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral1/memory/1300-12-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys CloudDrive.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" CloudDrive.exe -
Deletes itself 1 IoCs
pid Process 1160 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1300 CloudDrive.exe -
Loads dropped DLL 1 IoCs
pid Process 2756 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: CloudDrive.exe File opened (read-only) \??\E: CloudDrive.exe File opened (read-only) \??\G: CloudDrive.exe File opened (read-only) \??\I: CloudDrive.exe File opened (read-only) \??\N: CloudDrive.exe File opened (read-only) \??\P: CloudDrive.exe File opened (read-only) \??\Q: CloudDrive.exe File opened (read-only) \??\S: CloudDrive.exe File opened (read-only) \??\K: CloudDrive.exe File opened (read-only) \??\R: CloudDrive.exe File opened (read-only) \??\Z: CloudDrive.exe File opened (read-only) \??\T: CloudDrive.exe File opened (read-only) \??\U: CloudDrive.exe File opened (read-only) \??\V: CloudDrive.exe File opened (read-only) \??\X: CloudDrive.exe File opened (read-only) \??\Y: CloudDrive.exe File opened (read-only) \??\B: CloudDrive.exe File opened (read-only) \??\H: CloudDrive.exe File opened (read-only) \??\J: CloudDrive.exe File opened (read-only) \??\L: CloudDrive.exe File opened (read-only) \??\M: CloudDrive.exe File opened (read-only) \??\O: CloudDrive.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CloudDrive.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz CloudDrive.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2112 PING.EXE -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe 1300 CloudDrive.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1300 CloudDrive.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2756 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe Token: SeLoadDriverPrivilege 1300 CloudDrive.exe Token: 33 1300 CloudDrive.exe Token: SeIncBasePriorityPrivilege 1300 CloudDrive.exe Token: 33 1300 CloudDrive.exe Token: SeIncBasePriorityPrivilege 1300 CloudDrive.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2756 wrote to memory of 1300 2756 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe 28 PID 2756 wrote to memory of 1300 2756 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe 28 PID 2756 wrote to memory of 1300 2756 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe 28 PID 2756 wrote to memory of 1300 2756 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe 28 PID 2756 wrote to memory of 1160 2756 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe 29 PID 2756 wrote to memory of 1160 2756 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe 29 PID 2756 wrote to memory of 1160 2756 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe 29 PID 2756 wrote to memory of 1160 2756 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe 29 PID 1160 wrote to memory of 2112 1160 cmd.exe 31 PID 1160 wrote to memory of 2112 1160 cmd.exe 31 PID 1160 wrote to memory of 2112 1160 cmd.exe 31 PID 1160 wrote to memory of 2112 1160 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe"C:\Users\Admin\AppData\Local\Temp\376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CloudDrive.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CloudDrive.exe"2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\376E63~1.EXE > nul2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:2112
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD566acec1a55ec143bfa87f067db86ec66
SHA170ff059364d73bc75369d0d6a099dca45c79fcc5
SHA256376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73
SHA512b11d23b012433145b280464ab8798d57ab338a06dd78207264139551381b47c2d62609cc8d6f6bf5762e47ed18fb5e6cc244c084a1a243a31217bd6d5d34311f