Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2022 20:00

General

  • Target

    3af9063baf12a4bba385387dae90de868e795346fde803ad771fa830f3244b41.exe

  • Size

    460KB

  • MD5

    3971006fbc82286597136e9104621b6f

  • SHA1

    e26a94ad7b28be42c5717846d07d08b3dfb8357e

  • SHA256

    3af9063baf12a4bba385387dae90de868e795346fde803ad771fa830f3244b41

  • SHA512

    1a643106df2fc60be097d87d2a066c1d3e36241948679e5ad192585ede05a8ec60d073fc00d9b558d8cc506d95eae02b864dbe1a67678c7c30b4f4b773d0c68f

  • SSDEEP

    6144:QYrOnQRCjKoIlzTop+q1nkCHE9hGBnVHOZ5mLwRHG1dlV2wQL6tm/mdIp5b+:3X0KoIl3S+q+dGZonYwRHGzyLnp5i

Malware Config

Signatures

  • Detect PurpleFox Rootkit 7 IoCs

    Detect PurpleFox Rootkit.

  • Gh0st RAT payload 7 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3af9063baf12a4bba385387dae90de868e795346fde803ad771fa830f3244b41.exe
    "C:\Users\Admin\AppData\Local\Temp\3af9063baf12a4bba385387dae90de868e795346fde803ad771fa830f3244b41.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c md C:\ProgramData\Micros
      2⤵
        PID:4980
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c attrib C:\Users\Admin\AppData\Local\Temp\3AF906~1.EXE +s +h
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1604
        • C:\Windows\SysWOW64\attrib.exe
          attrib C:\Users\Admin\AppData\Local\Temp\3AF906~1.EXE +s +h
          3⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:952
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c md C:\ProgramData\Micros
        2⤵
          PID:5072
        • C:\ProgramData\windows.exe
          C:\ProgramData\windows.exe
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Adds Run key to start application
          • Enumerates connected drives
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1292
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c attrib C:\PROGRA~3\windows.exe +s +h
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2488
            • C:\Windows\SysWOW64\attrib.exe
              attrib C:\PROGRA~3\windows.exe +s +h
              4⤵
              • Sets file to hidden
              • Drops file in Program Files directory
              • Views/modifies file attributes
              PID:552
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c md C:\ProgramData\ru
            3⤵
              PID:216

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Hidden Files and Directories

        2
        T1158

        Registry Run Keys / Startup Folder

        1
        T1060

        Defense Evasion

        Hidden Files and Directories

        2
        T1158

        Modify Registry

        1
        T1112

        Discovery

        Query Registry

        3
        T1012

        System Information Discovery

        4
        T1082

        Peripheral Device Discovery

        1
        T1120

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Micros\1.txt
          Filesize

          76KB

          MD5

          a0174e9945895fa8ace11f6bb4a64298

          SHA1

          527c4ebc005deb88f29edd83a23ac977735d76c4

          SHA256

          2dcd521895377ae3463dd61369c7fc6aafd8610e020592bf29b88888fc295ca0

          SHA512

          974f26161cc94c42fbe781db476562ccee90051f5c419ad156d4d17ab63231fa62a064c32cf1acc648e06d01d7f69e785f1421407859f2d78976d76a89b27dec

        • C:\ProgramData\Micros\2.txt
          Filesize

          44KB

          MD5

          96d097045736a2a1526d63c2d83a6b22

          SHA1

          dde933d7fcc22e41f981d043a3aa835e3b19f86e

          SHA256

          abbd451b402243bf00ad76f253d2b1c3f80d1d6f6c7f5b2f0d5e3fdd7f9c06e5

          SHA512

          e6ef5a7f25af760fef212b46b1796b8b386575e258a8b02a4c74510bb600e7fac3d344cceae14ef4b72a2520022e7cc611b34a56f737892ed4970ed1150945bd

        • C:\ProgramData\SHELL.TXT
          Filesize

          1.2MB

          MD5

          3a609e0c8a5d9c5f8ca058f767fa20cf

          SHA1

          791ddf60a63150bffee4e7453679a78853ffcb7c

          SHA256

          f6386b915a9a1344fd7d40850132bca0f54a8cfb43721021049e968c32536799

          SHA512

          fbe66dd84b9bad885d843c662992aa3a9b3d25b14a3acfcdb13b04547836295c37b0f9cf4fb8b7c0537de9601992e1c4275e9e1a841a130f3efb2b1e7fb34f35

        • C:\ProgramData\SHELL.ini
          Filesize

          49B

          MD5

          6f415b6df7f2f6858d0ca9f4de095ff5

          SHA1

          b5abbe56cbbadb38cc645422b3df1b6c2935a8f9

          SHA256

          fb5a2e50dde8d004759f71297ab1c83fb2d16cd516b04a069948d98bc2bc06c6

          SHA512

          59cb30200bf199802d97c808c283ce1d3870b8f1d23dac42e67e33576b10bbcbc92f1510698c65afea7a70cc6c8860f53ef5d77d99a8f226c7b63d0584ebdfcd

        • C:\ProgramData\windows.exe
          Filesize

          460KB

          MD5

          3971006fbc82286597136e9104621b6f

          SHA1

          e26a94ad7b28be42c5717846d07d08b3dfb8357e

          SHA256

          3af9063baf12a4bba385387dae90de868e795346fde803ad771fa830f3244b41

          SHA512

          1a643106df2fc60be097d87d2a066c1d3e36241948679e5ad192585ede05a8ec60d073fc00d9b558d8cc506d95eae02b864dbe1a67678c7c30b4f4b773d0c68f

        • C:\ProgramData\windows.exe
          Filesize

          460KB

          MD5

          3971006fbc82286597136e9104621b6f

          SHA1

          e26a94ad7b28be42c5717846d07d08b3dfb8357e

          SHA256

          3af9063baf12a4bba385387dae90de868e795346fde803ad771fa830f3244b41

          SHA512

          1a643106df2fc60be097d87d2a066c1d3e36241948679e5ad192585ede05a8ec60d073fc00d9b558d8cc506d95eae02b864dbe1a67678c7c30b4f4b773d0c68f

        • memory/216-149-0x0000000000000000-mapping.dmp
        • memory/552-147-0x0000000000000000-mapping.dmp
        • memory/952-138-0x0000000000000000-mapping.dmp
        • memory/1292-148-0x0000000002410000-0x00000000025B6000-memory.dmp
          Filesize

          1.6MB

        • memory/1292-144-0x0000000002410000-0x00000000025B6000-memory.dmp
          Filesize

          1.6MB

        • memory/1292-152-0x0000000002410000-0x00000000025B6000-memory.dmp
          Filesize

          1.6MB

        • memory/1292-139-0x0000000000000000-mapping.dmp
        • memory/1604-135-0x0000000000000000-mapping.dmp
        • memory/2412-132-0x0000000002F70000-0x0000000003116000-memory.dmp
          Filesize

          1.6MB

        • memory/2412-145-0x0000000002F70000-0x0000000003116000-memory.dmp
          Filesize

          1.6MB

        • memory/2412-134-0x0000000002F70000-0x0000000003116000-memory.dmp
          Filesize

          1.6MB

        • memory/2412-133-0x0000000002E30000-0x0000000002F69000-memory.dmp
          Filesize

          1.2MB

        • memory/2488-146-0x0000000000000000-mapping.dmp
        • memory/4980-136-0x0000000000000000-mapping.dmp
        • memory/5072-137-0x0000000000000000-mapping.dmp