Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 03:43
Static task
static1
Behavioral task
behavioral1
Sample
ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb.exe
Resource
win7-20240611-en
General
-
Target
ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb.exe
-
Size
3.5MB
-
MD5
4972e410b438253f1cf2712789b456ed
-
SHA1
78823929302ae341b551f583d7493e9c25a14f29
-
SHA256
ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb
-
SHA512
e08013dfe5fc9303914922c12de4cda9e90b6995bd96210ad95a75a1c625364f2c9a34bbe4c0d6e37450ec90dbbed762ea2e92cc824169d3c7a3e862b5f52d94
-
SSDEEP
24576:VOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNHzP:IHPkVOBTKb
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1548-0-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1548-0-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
sainbox.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys sainbox.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
sainbox.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" sainbox.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2056 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
sainbox.exesainbox.exepid process 2340 sainbox.exe 2348 sainbox.exe -
Loads dropped DLL 1 IoCs
Processes:
sainbox.exepid process 2340 sainbox.exe -
Drops file in System32 directory 2 IoCs
Processes:
ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb.exedescription ioc process File created C:\Windows\SysWOW64\sainbox.exe ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb.exe File opened for modification C:\Windows\SysWOW64\sainbox.exe ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb.exe -
Modifies data under HKEY_USERS 4 IoCs
Processes:
sainbox.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings sainbox.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix sainbox.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" sainbox.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" sainbox.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
sainbox.exepid process 2348 sainbox.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb.exesainbox.exedescription pid process Token: SeIncBasePriorityPrivilege 1548 ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb.exe Token: SeLoadDriverPrivilege 2348 sainbox.exe Token: 33 2348 sainbox.exe Token: SeIncBasePriorityPrivilege 2348 sainbox.exe Token: 33 2348 sainbox.exe Token: SeIncBasePriorityPrivilege 2348 sainbox.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb.exesainbox.execmd.exedescription pid process target process PID 1548 wrote to memory of 2056 1548 ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb.exe cmd.exe PID 1548 wrote to memory of 2056 1548 ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb.exe cmd.exe PID 1548 wrote to memory of 2056 1548 ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb.exe cmd.exe PID 1548 wrote to memory of 2056 1548 ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb.exe cmd.exe PID 2340 wrote to memory of 2348 2340 sainbox.exe sainbox.exe PID 2340 wrote to memory of 2348 2340 sainbox.exe sainbox.exe PID 2340 wrote to memory of 2348 2340 sainbox.exe sainbox.exe PID 2340 wrote to memory of 2348 2340 sainbox.exe sainbox.exe PID 2056 wrote to memory of 2632 2056 cmd.exe PING.EXE PID 2056 wrote to memory of 2632 2056 cmd.exe PING.EXE PID 2056 wrote to memory of 2632 2056 cmd.exe PING.EXE PID 2056 wrote to memory of 2632 2056 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb.exe"C:\Users\Admin\AppData\Local\Temp\ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\FF104A~1.EXE > nul2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\sainbox.exeC:\Windows\SysWOW64\sainbox.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sainbox.exeC:\Windows\SysWOW64\sainbox.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\sainbox.exeFilesize
3.5MB
MD54972e410b438253f1cf2712789b456ed
SHA178823929302ae341b551f583d7493e9c25a14f29
SHA256ff104af9ac96af3d9472c02495b55a4a623e32cadb1486b004bb7fd65c093feb
SHA512e08013dfe5fc9303914922c12de4cda9e90b6995bd96210ad95a75a1c625364f2c9a34bbe4c0d6e37450ec90dbbed762ea2e92cc824169d3c7a3e862b5f52d94
-
memory/1548-0-0x0000000010000000-0x000000001019F000-memory.dmpFilesize
1.6MB