Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 21:33
Static task
static1
Behavioral task
behavioral1
Sample
e7e96cda8a476844be3a605f7b616cf98ca3f41b7f607a2a7b98da5d403014ee.exe
Resource
win7-20240419-en
General
-
Target
e7e96cda8a476844be3a605f7b616cf98ca3f41b7f607a2a7b98da5d403014ee.exe
-
Size
11.3MB
-
MD5
26ef3ab737b2c1ba492ccdb6860167c5
-
SHA1
c8c6bdd17ffebfceceeedb018e36f053a00ddeef
-
SHA256
e7e96cda8a476844be3a605f7b616cf98ca3f41b7f607a2a7b98da5d403014ee
-
SHA512
51f50842227e54eb7e5b3c6ba8581f15b4c1975186cb0a329f637abe5570a47b1158d8f3c8077f92801108179832a57e1dc3cb7a8d6114099d7540abb8da0452
-
SSDEEP
24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNsI:QHPkVOBTKz
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1028-0-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral1/memory/2556-19-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/memory/1028-0-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral1/memory/2556-19-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys sainbox.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" sainbox.exe -
Deletes itself 1 IoCs
pid Process 2660 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2432 sainbox.exe 2556 sainbox.exe -
Loads dropped DLL 1 IoCs
pid Process 2432 sainbox.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\sainbox.exe e7e96cda8a476844be3a605f7b616cf98ca3f41b7f607a2a7b98da5d403014ee.exe File opened for modification C:\Windows\SysWOW64\sainbox.exe e7e96cda8a476844be3a605f7b616cf98ca3f41b7f607a2a7b98da5d403014ee.exe -
Modifies data under HKEY_USERS 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" sainbox.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings sainbox.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix sainbox.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" sainbox.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1844 PING.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2556 sainbox.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1028 e7e96cda8a476844be3a605f7b616cf98ca3f41b7f607a2a7b98da5d403014ee.exe Token: SeLoadDriverPrivilege 2556 sainbox.exe Token: 33 2556 sainbox.exe Token: SeIncBasePriorityPrivilege 2556 sainbox.exe Token: 33 2556 sainbox.exe Token: SeIncBasePriorityPrivilege 2556 sainbox.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1028 wrote to memory of 2660 1028 e7e96cda8a476844be3a605f7b616cf98ca3f41b7f607a2a7b98da5d403014ee.exe 29 PID 1028 wrote to memory of 2660 1028 e7e96cda8a476844be3a605f7b616cf98ca3f41b7f607a2a7b98da5d403014ee.exe 29 PID 1028 wrote to memory of 2660 1028 e7e96cda8a476844be3a605f7b616cf98ca3f41b7f607a2a7b98da5d403014ee.exe 29 PID 1028 wrote to memory of 2660 1028 e7e96cda8a476844be3a605f7b616cf98ca3f41b7f607a2a7b98da5d403014ee.exe 29 PID 2432 wrote to memory of 2556 2432 sainbox.exe 31 PID 2432 wrote to memory of 2556 2432 sainbox.exe 31 PID 2432 wrote to memory of 2556 2432 sainbox.exe 31 PID 2432 wrote to memory of 2556 2432 sainbox.exe 31 PID 2660 wrote to memory of 1844 2660 cmd.exe 32 PID 2660 wrote to memory of 1844 2660 cmd.exe 32 PID 2660 wrote to memory of 1844 2660 cmd.exe 32 PID 2660 wrote to memory of 1844 2660 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7e96cda8a476844be3a605f7b616cf98ca3f41b7f607a2a7b98da5d403014ee.exe"C:\Users\Admin\AppData\Local\Temp\e7e96cda8a476844be3a605f7b616cf98ca3f41b7f607a2a7b98da5d403014ee.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\E7E96C~1.EXE > nul2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:1844
-
-
-
C:\Windows\SysWOW64\sainbox.exeC:\Windows\SysWOW64\sainbox.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\sainbox.exeC:\Windows\SysWOW64\sainbox.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.3MB
MD526ef3ab737b2c1ba492ccdb6860167c5
SHA1c8c6bdd17ffebfceceeedb018e36f053a00ddeef
SHA256e7e96cda8a476844be3a605f7b616cf98ca3f41b7f607a2a7b98da5d403014ee
SHA51251f50842227e54eb7e5b3c6ba8581f15b4c1975186cb0a329f637abe5570a47b1158d8f3c8077f92801108179832a57e1dc3cb7a8d6114099d7540abb8da0452