Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-10-2022 23:20
Static task
static1
Behavioral task
behavioral1
Sample
f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591.exe
Resource
win7-20220812-en
General
-
Target
f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591.exe
-
Size
377KB
-
MD5
d0ccd1ef73a60b65e796da49328291a8
-
SHA1
5e91f99b304bbdc0b7759ea81017d4d6690a8fdf
-
SHA256
f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591
-
SHA512
57bac31de4c14713b8faeb6bd323968ed4d3c9cc7a715764836eb9362b1ddcf913569f04af5d45e600f545bc9197e3f069e3706a855fe9f6545ab40751d53d62
-
SSDEEP
6144:bYrjz6wmPuD78neE6DpQLQNIzXpWR/6QwvcjFuJtuzvdwkjr7nc:qmkD4eE6DqfXpWB6QwEjEzuzND
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1048-57-0x0000000010000000-0x00000000101B5000-memory.dmp purplefox_rootkit behavioral1/memory/1048-58-0x0000000010000000-0x00000000101B5000-memory.dmp purplefox_rootkit behavioral1/memory/960-69-0x0000000010000000-0x00000000101B5000-memory.dmp purplefox_rootkit behavioral1/memory/1048-68-0x0000000010000000-0x00000000101B5000-memory.dmp purplefox_rootkit behavioral1/memory/1424-77-0x0000000010000000-0x00000000101B5000-memory.dmp purplefox_rootkit behavioral1/memory/1424-78-0x0000000010000000-0x00000000101B5000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1048-57-0x0000000010000000-0x00000000101B5000-memory.dmp family_gh0strat behavioral1/memory/1048-58-0x0000000010000000-0x00000000101B5000-memory.dmp family_gh0strat behavioral1/memory/960-69-0x0000000010000000-0x00000000101B5000-memory.dmp family_gh0strat behavioral1/memory/1048-68-0x0000000010000000-0x00000000101B5000-memory.dmp family_gh0strat behavioral1/memory/1424-77-0x0000000010000000-0x00000000101B5000-memory.dmp family_gh0strat behavioral1/memory/1424-78-0x0000000010000000-0x00000000101B5000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
Vnoph.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys Vnoph.exe -
Executes dropped EXE 2 IoCs
Processes:
Vnoph.exeVnoph.exepid process 960 Vnoph.exe 1424 Vnoph.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
Vnoph.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Vnoph.exe -
Processes:
resource yara_rule behavioral1/memory/1048-55-0x0000000010000000-0x00000000101B5000-memory.dmp upx behavioral1/memory/1048-57-0x0000000010000000-0x00000000101B5000-memory.dmp upx behavioral1/memory/1048-58-0x0000000010000000-0x00000000101B5000-memory.dmp upx behavioral1/memory/960-69-0x0000000010000000-0x00000000101B5000-memory.dmp upx behavioral1/memory/1048-68-0x0000000010000000-0x00000000101B5000-memory.dmp upx behavioral1/memory/1424-77-0x0000000010000000-0x00000000101B5000-memory.dmp upx behavioral1/memory/1424-78-0x0000000010000000-0x00000000101B5000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1356 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
Vnoph.exepid process 960 Vnoph.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Vnoph.exedescription ioc process File opened (read-only) \??\N: Vnoph.exe File opened (read-only) \??\O: Vnoph.exe File opened (read-only) \??\S: Vnoph.exe File opened (read-only) \??\U: Vnoph.exe File opened (read-only) \??\X: Vnoph.exe File opened (read-only) \??\F: Vnoph.exe File opened (read-only) \??\K: Vnoph.exe File opened (read-only) \??\L: Vnoph.exe File opened (read-only) \??\W: Vnoph.exe File opened (read-only) \??\B: Vnoph.exe File opened (read-only) \??\G: Vnoph.exe File opened (read-only) \??\M: Vnoph.exe File opened (read-only) \??\R: Vnoph.exe File opened (read-only) \??\T: Vnoph.exe File opened (read-only) \??\V: Vnoph.exe File opened (read-only) \??\E: Vnoph.exe File opened (read-only) \??\I: Vnoph.exe File opened (read-only) \??\P: Vnoph.exe File opened (read-only) \??\Q: Vnoph.exe File opened (read-only) \??\Y: Vnoph.exe File opened (read-only) \??\Z: Vnoph.exe File opened (read-only) \??\H: Vnoph.exe File opened (read-only) \??\J: Vnoph.exe -
Drops file in System32 directory 2 IoCs
Processes:
f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591.exedescription ioc process File created C:\Windows\SysWOW64\Vnoph.exe f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591.exe File opened for modification C:\Windows\SysWOW64\Vnoph.exe f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Vnoph.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Vnoph.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Vnoph.exe -
Modifies data under HKEY_USERS 6 IoCs
Processes:
Vnoph.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Vnoph.exe Key created \REGISTRY\USER\.DEFAULT\Software Vnoph.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft Vnoph.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie Vnoph.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum Vnoph.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" Vnoph.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
Vnoph.exepid process 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe 1424 Vnoph.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
Vnoph.exepid process 1424 Vnoph.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591.exeVnoph.exedescription pid process Token: SeIncBasePriorityPrivilege 1048 f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591.exe Token: SeLoadDriverPrivilege 1424 Vnoph.exe Token: 33 1424 Vnoph.exe Token: SeIncBasePriorityPrivilege 1424 Vnoph.exe Token: 33 1424 Vnoph.exe Token: SeIncBasePriorityPrivilege 1424 Vnoph.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591.exeVnoph.execmd.exedescription pid process target process PID 1048 wrote to memory of 1356 1048 f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591.exe cmd.exe PID 1048 wrote to memory of 1356 1048 f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591.exe cmd.exe PID 1048 wrote to memory of 1356 1048 f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591.exe cmd.exe PID 1048 wrote to memory of 1356 1048 f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591.exe cmd.exe PID 960 wrote to memory of 1424 960 Vnoph.exe Vnoph.exe PID 960 wrote to memory of 1424 960 Vnoph.exe Vnoph.exe PID 960 wrote to memory of 1424 960 Vnoph.exe Vnoph.exe PID 960 wrote to memory of 1424 960 Vnoph.exe Vnoph.exe PID 960 wrote to memory of 1424 960 Vnoph.exe Vnoph.exe PID 960 wrote to memory of 1424 960 Vnoph.exe Vnoph.exe PID 960 wrote to memory of 1424 960 Vnoph.exe Vnoph.exe PID 1356 wrote to memory of 1940 1356 cmd.exe PING.EXE PID 1356 wrote to memory of 1940 1356 cmd.exe PING.EXE PID 1356 wrote to memory of 1940 1356 cmd.exe PING.EXE PID 1356 wrote to memory of 1940 1356 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591.exe"C:\Users\Admin\AppData\Local\Temp\f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\F53F53~1.EXE > nul2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\Vnoph.exeC:\Windows\SysWOW64\Vnoph.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Vnoph.exeC:\Windows\SysWOW64\Vnoph.exe -acsi2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Enumerates connected drives
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Vnoph.exeFilesize
377KB
MD5d0ccd1ef73a60b65e796da49328291a8
SHA15e91f99b304bbdc0b7759ea81017d4d6690a8fdf
SHA256f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591
SHA51257bac31de4c14713b8faeb6bd323968ed4d3c9cc7a715764836eb9362b1ddcf913569f04af5d45e600f545bc9197e3f069e3706a855fe9f6545ab40751d53d62
-
C:\Windows\SysWOW64\Vnoph.exeFilesize
377KB
MD5d0ccd1ef73a60b65e796da49328291a8
SHA15e91f99b304bbdc0b7759ea81017d4d6690a8fdf
SHA256f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591
SHA51257bac31de4c14713b8faeb6bd323968ed4d3c9cc7a715764836eb9362b1ddcf913569f04af5d45e600f545bc9197e3f069e3706a855fe9f6545ab40751d53d62
-
\Windows\SysWOW64\Vnoph.exeFilesize
377KB
MD5d0ccd1ef73a60b65e796da49328291a8
SHA15e91f99b304bbdc0b7759ea81017d4d6690a8fdf
SHA256f53f5380bb1f1a97bb57979d1f68d56944b43dd4fd951db1a006df5b325a4591
SHA51257bac31de4c14713b8faeb6bd323968ed4d3c9cc7a715764836eb9362b1ddcf913569f04af5d45e600f545bc9197e3f069e3706a855fe9f6545ab40751d53d62
-
memory/960-69-0x0000000010000000-0x00000000101B5000-memory.dmpFilesize
1.7MB
-
memory/1048-58-0x0000000010000000-0x00000000101B5000-memory.dmpFilesize
1.7MB
-
memory/1048-54-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1048-57-0x0000000010000000-0x00000000101B5000-memory.dmpFilesize
1.7MB
-
memory/1048-68-0x0000000010000000-0x00000000101B5000-memory.dmpFilesize
1.7MB
-
memory/1048-55-0x0000000010000000-0x00000000101B5000-memory.dmpFilesize
1.7MB
-
memory/1356-65-0x0000000000000000-mapping.dmp
-
memory/1424-67-0x0000000000000000-mapping.dmp
-
memory/1424-77-0x0000000010000000-0x00000000101B5000-memory.dmpFilesize
1.7MB
-
memory/1424-78-0x0000000010000000-0x00000000101B5000-memory.dmpFilesize
1.7MB
-
memory/1940-76-0x0000000000000000-mapping.dmp