Analysis
-
max time kernel
146s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe
Resource
win7-20240221-en
General
-
Target
376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe
-
Size
1.3MB
-
MD5
66acec1a55ec143bfa87f067db86ec66
-
SHA1
70ff059364d73bc75369d0d6a099dca45c79fcc5
-
SHA256
376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73
-
SHA512
b11d23b012433145b280464ab8798d57ab338a06dd78207264139551381b47c2d62609cc8d6f6bf5762e47ed18fb5e6cc244c084a1a243a31217bd6d5d34311f
-
SSDEEP
24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNN:QHPkVOBTK
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2208-0-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2208-0-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys CloudDrive.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" CloudDrive.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe -
Executes dropped EXE 1 IoCs
pid Process 1576 CloudDrive.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: CloudDrive.exe File opened (read-only) \??\Q: CloudDrive.exe File opened (read-only) \??\R: CloudDrive.exe File opened (read-only) \??\V: CloudDrive.exe File opened (read-only) \??\Z: CloudDrive.exe File opened (read-only) \??\B: CloudDrive.exe File opened (read-only) \??\J: CloudDrive.exe File opened (read-only) \??\K: CloudDrive.exe File opened (read-only) \??\S: CloudDrive.exe File opened (read-only) \??\W: CloudDrive.exe File opened (read-only) \??\X: CloudDrive.exe File opened (read-only) \??\H: CloudDrive.exe File opened (read-only) \??\I: CloudDrive.exe File opened (read-only) \??\O: CloudDrive.exe File opened (read-only) \??\U: CloudDrive.exe File opened (read-only) \??\E: CloudDrive.exe File opened (read-only) \??\M: CloudDrive.exe File opened (read-only) \??\T: CloudDrive.exe File opened (read-only) \??\Y: CloudDrive.exe File opened (read-only) \??\G: CloudDrive.exe File opened (read-only) \??\N: CloudDrive.exe File opened (read-only) \??\P: CloudDrive.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CloudDrive.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz CloudDrive.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1664 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe 1576 CloudDrive.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1576 CloudDrive.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2208 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe Token: SeLoadDriverPrivilege 1576 CloudDrive.exe Token: 33 1576 CloudDrive.exe Token: SeIncBasePriorityPrivilege 1576 CloudDrive.exe Token: 33 1576 CloudDrive.exe Token: SeIncBasePriorityPrivilege 1576 CloudDrive.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2208 wrote to memory of 1576 2208 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe 90 PID 2208 wrote to memory of 1576 2208 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe 90 PID 2208 wrote to memory of 1576 2208 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe 90 PID 2208 wrote to memory of 4548 2208 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe 91 PID 2208 wrote to memory of 4548 2208 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe 91 PID 2208 wrote to memory of 4548 2208 376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe 91 PID 4548 wrote to memory of 1664 4548 cmd.exe 93 PID 4548 wrote to memory of 1664 4548 cmd.exe 93 PID 4548 wrote to memory of 1664 4548 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe"C:\Users\Admin\AppData\Local\Temp\376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CloudDrive.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CloudDrive.exe"2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1576
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\376E63~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:1664
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD566acec1a55ec143bfa87f067db86ec66
SHA170ff059364d73bc75369d0d6a099dca45c79fcc5
SHA256376e63d4347c99f57f26214047f5814e332b8d4b0b52a17d3024eac0c48b8c73
SHA512b11d23b012433145b280464ab8798d57ab338a06dd78207264139551381b47c2d62609cc8d6f6bf5762e47ed18fb5e6cc244c084a1a243a31217bd6d5d34311f