Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20240419-en - resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system - submitted
27/05/2024, 11:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe
- Size 9.3MB
- Sample240527-m9s8nahc8v
- SHA256 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065
- MD5 598f99c870529c864b369aff4b27fc20
- SHA1 867bb49c288e93ac0fbd6631183373be56527c79
- SHA512 1114a296257e5092f714073ee8542fc6ed3cc14ccadad45a2ab452b219f1b71faacd6a071c83ac1cad8919d418536e7701c18982bdc58aca5cc8421bb43f1973
- SSDEEP 24576:IGAbS7ZX8hjUTgcUjChFMT9ChBZCWERAmpJKOf7ygPYoU1RI5tsBydOfC/zg347N:/1RTxUmiTIhHicg1U1RI5tsB4772qc2
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/904-3-0x0000000003500000-0x000000000363F000-memory.dmp purplefox_rootkit behavioral2/memory/904-4-0x0000000003640000-0x00000000037EC000-memory.dmp purplefox_rootkit behavioral2/memory/904-15-0x0000000003640000-0x00000000037EC000-memory.dmp purplefox_rootkit behavioral2/memory/904-12-0x0000000003640000-0x00000000037EC000-memory.dmp purplefox_rootkit behavioral2/memory/904-5-0x0000000003640000-0x00000000037EC000-memory.dmp purplefox_rootkit behavioral2/memory/904-39-0x0000000003640000-0x00000000037EC000-memory.dmp purplefox_rootkit - Gh0st RAT payload 6 IoCs
resource yara_rule behavioral2/memory/904-3-0x0000000003500000-0x000000000363F000-memory.dmp family_gh0strat behavioral2/memory/904-4-0x0000000003640000-0x00000000037EC000-memory.dmp family_gh0strat behavioral2/memory/904-15-0x0000000003640000-0x00000000037EC000-memory.dmp family_gh0strat behavioral2/memory/904-12-0x0000000003640000-0x00000000037EC000-memory.dmp family_gh0strat behavioral2/memory/904-5-0x0000000003640000-0x00000000037EC000-memory.dmp family_gh0strat behavioral2/memory/904-39-0x0000000003640000-0x00000000037EC000-memory.dmp family_gh0strat - Downloads MZ/PE file
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\°²È«·À»¤ÖÐÐÄÄ£¿é = "C:\\Users\\Public\\Documents\\MM\\svchost.exe" 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\V: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\X: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\Y: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\H: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\J: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\K: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\S: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\Z: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\M: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\N: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\P: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\I: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\L: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\O: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\R: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\U: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\B: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\E: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\G: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\Q: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe File opened (read-only) \??\W: 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe Token: SeIncBasePriorityPrivilege 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe Token: 33 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe Token: SeIncBasePriorityPrivilege 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 904 wrote to memory of 3320 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 79 PID 904 wrote to memory of 3320 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 79 PID 904 wrote to memory of 3320 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 79 PID 904 wrote to memory of 1604 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 80 PID 904 wrote to memory of 1604 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 80 PID 904 wrote to memory of 1604 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 80 PID 904 wrote to memory of 4576 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 84 PID 904 wrote to memory of 4576 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 84 PID 904 wrote to memory of 4576 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 84 PID 904 wrote to memory of 1036 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 86 PID 904 wrote to memory of 1036 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 86 PID 904 wrote to memory of 1036 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 86 PID 904 wrote to memory of 3124 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 88 PID 904 wrote to memory of 3124 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 88 PID 904 wrote to memory of 3124 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 88 PID 904 wrote to memory of 3680 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 90 PID 904 wrote to memory of 3680 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 90 PID 904 wrote to memory of 3680 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 90 PID 904 wrote to memory of 3456 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 92 PID 904 wrote to memory of 3456 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 92 PID 904 wrote to memory of 3456 904 8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe"C:\Users\Admin\AppData\Local\Temp\8b24e43d325a556c6797cc7753f6a555d47b0c7f24bad99b2009baf8a0796065.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\cmd.execmd /c md C:\Users\Public\Documents\MM2⤵PID:3320
-
-
C:\Windows\SysWOW64\cmd.execmd /c md C:\Users\Public\Documents\MM2⤵PID:1604
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Query /TN MM2⤵PID:4576
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Query /TN MM2⤵PID:1036
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Query /TN MM2⤵PID:3124
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Query /TN MM2⤵PID:3680
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Query /TN MM2⤵PID:3456
-