Analysis
-
max time kernel
92s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2024 08:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
instai.exe
Resource
win7-20240729-en
windows7-x64
9 signatures
150 seconds
General
-
Target
instai.exe
-
Size
80.7MB
-
MD5
5cf1740d40bc4ee089e92624466bf4ad
-
SHA1
a3a5761427e1fe202f165237fcc125044c1da30f
-
SHA256
9a05e3f7c57ebb3a8190caa6fd5cfadaed6e3b635697d5c3e3d442ed3c989ae8
-
SHA512
33a4038770e51354f7138d85edce23038e0f73a9497cd9fab17bac72628f57c376cf9311a0a5833cf9d3a17b628a4ef2c2b43130aeafc5acc430bc3da10f00f8
-
SSDEEP
1572864:JsFmG/LCRZCLYQUux91mt46TpmSHGErH5y0oBO/rWZqyKjVnQTnP:Jf0sQr1mt4WpmSzQBFyO
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4536-0-0x0000000010000000-0x0000000010199000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4536-0-0x0000000010000000-0x0000000010199000-memory.dmp family_gh0strat -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: instai.exe File opened (read-only) \??\K: instai.exe File opened (read-only) \??\Q: instai.exe File opened (read-only) \??\X: instai.exe File opened (read-only) \??\Z: instai.exe File opened (read-only) \??\P: instai.exe File opened (read-only) \??\R: instai.exe File opened (read-only) \??\W: instai.exe File opened (read-only) \??\B: instai.exe File opened (read-only) \??\G: instai.exe File opened (read-only) \??\L: instai.exe File opened (read-only) \??\M: instai.exe File opened (read-only) \??\N: instai.exe File opened (read-only) \??\Y: instai.exe File opened (read-only) \??\J: instai.exe File opened (read-only) \??\T: instai.exe File opened (read-only) \??\V: instai.exe File opened (read-only) \??\E: instai.exe File opened (read-only) \??\H: instai.exe File opened (read-only) \??\O: instai.exe File opened (read-only) \??\S: instai.exe File opened (read-only) \??\U: instai.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language instai.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 instai.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz instai.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe 4536 instai.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4536 instai.exe