Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
22-03-2023 11:29
General
-
Target
9324c220867ead4a8d0d24dc888593081970c33dbc063f94f77beadbc8793639.exe
-
Size
5.7MB
-
MD5
ffa7d3236dc39beeda2da5f2b0596776
-
SHA1
c1a6afa1fc069c2bf93b1dcd59a646db253720bb
-
SHA256
9324c220867ead4a8d0d24dc888593081970c33dbc063f94f77beadbc8793639
-
SHA512
5016a5e3a483abfa841d2d8f33e7fbdb96bd4bd8119ae96a05cf2c5483f7fdbd5d7c333dfed63e9b94554637adebd982296e00e5fc2a3ffba3bd75e477349e7b
-
SSDEEP
98304:53YBvx6ppDENRyHDqAVMSBEzSmwAwfSqXgRfkgO6irkr5JfEw5zbLBJoAtv8YXny:WBv4ppDSDwMSCzSvAwKXormXLjdzwJ
Malware Config
Signatures
-
Detect PurpleFox Rootkit 1 IoCs
Detect PurpleFox Rootkit.
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9324c220867ead4a8d0d24dc888593081970c33dbc063f94f77beadbc8793639.exe"C:\Users\Admin\AppData\Local\Temp\9324c220867ead4a8d0d24dc888593081970c33dbc063f94f77beadbc8793639.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
499KB
MD56d5709a3ffbec9bc59dd2ceaf7c8536a
SHA1ab220f11cf0845a2695fd71f30afd18d126bd6f0
SHA256647a56901e4f2a009533eaff8dd32cc7d654c83a3a07c6b05e7be6731d8fcbde
SHA512dc7645a61810dd0c36b1e03e3e162f3568a380c87c4ae7054885c356449c2ab9972afccd0b96c23a1fe4a9a29b3a02a2cd08a856d304f5ef85ebc0b9cbb461fc
-
Filesize
26.3MB
-
Filesize
26.3MB
-
Filesize
26.3MB
-
Filesize
26.3MB
-
Filesize
26.3MB
-
Filesize
26.3MB
-
Filesize
26.3MB
-
Filesize
26.3MB
-
Filesize
26.3MB
-
Filesize
264KB
-
Filesize
26.3MB
-
Filesize
3.8MB
-
Filesize
1.3MB
-
Filesize
26.3MB
-
Filesize
26.3MB
-
Filesize
26.3MB
-
Filesize
26.3MB
-
Filesize
26.3MB
-
Filesize
26.3MB
-
Filesize
26.3MB