Analysis
-
max time kernel
148s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-04-2023 11:05
Static task
static1
Behavioral task
behavioral1
Sample
1993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c.exe
Resource
win7-20230220-en
General
-
Target
1993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c.exe
-
Size
840KB
-
MD5
29134e6a1688ce88edf31e1146be282d
-
SHA1
5aea9e4de2a42900f26304bab5cf1dc6954dfc41
-
SHA256
1993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c
-
SHA512
9b3baba119241a7ea0fd5671ab5a967fd347b2cbb09eb90e9f63e945daae0254fce9dcf020ab035cc1f481033a0ca9cf298a7b043b96f7b65c9fd83445876a2a
-
SSDEEP
12288:VRS7sigf4wDtUDQ6DFhsQbi5VV1r39MTdpB+IuDTHjovji6DECf0TT:7SwDcvD0Qb2taTdpsIuDrjoriy0T
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2000-54-0x0000000010000000-0x00000000101A0000-memory.dmp purplefox_rootkit behavioral1/memory/2000-62-0x0000000000400000-0x00000000005CA8A1-memory.dmp purplefox_rootkit behavioral1/memory/796-72-0x0000000000400000-0x00000000005CA8A1-memory.dmp purplefox_rootkit behavioral1/memory/2000-73-0x0000000000400000-0x00000000005CA8A1-memory.dmp purplefox_rootkit behavioral1/memory/796-75-0x0000000000400000-0x00000000005CA8A1-memory.dmp purplefox_rootkit behavioral1/memory/1772-76-0x0000000010000000-0x00000000101A0000-memory.dmp purplefox_rootkit behavioral1/memory/1772-83-0x0000000000400000-0x00000000005CA8A1-memory.dmp purplefox_rootkit -
Gh0st RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/2000-54-0x0000000010000000-0x00000000101A0000-memory.dmp family_gh0strat behavioral1/memory/2000-62-0x0000000000400000-0x00000000005CA8A1-memory.dmp family_gh0strat behavioral1/memory/796-72-0x0000000000400000-0x00000000005CA8A1-memory.dmp family_gh0strat behavioral1/memory/2000-73-0x0000000000400000-0x00000000005CA8A1-memory.dmp family_gh0strat behavioral1/memory/796-75-0x0000000000400000-0x00000000005CA8A1-memory.dmp family_gh0strat behavioral1/memory/1772-76-0x0000000010000000-0x00000000101A0000-memory.dmp family_gh0strat behavioral1/memory/1772-83-0x0000000000400000-0x00000000005CA8A1-memory.dmp family_gh0strat -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 588 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
Skcsk.exeSkcsk.exepid process 796 Skcsk.exe 1772 Skcsk.exe -
Drops file in System32 directory 2 IoCs
Processes:
1993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c.exedescription ioc process File created C:\Windows\SysWOW64\Skcsk.exe 1993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c.exe File opened for modification C:\Windows\SysWOW64\Skcsk.exe 1993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c.exedescription pid process Token: SeIncBasePriorityPrivilege 2000 1993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c.exeSkcsk.execmd.exedescription pid process target process PID 2000 wrote to memory of 588 2000 1993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c.exe cmd.exe PID 2000 wrote to memory of 588 2000 1993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c.exe cmd.exe PID 2000 wrote to memory of 588 2000 1993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c.exe cmd.exe PID 2000 wrote to memory of 588 2000 1993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c.exe cmd.exe PID 796 wrote to memory of 1772 796 Skcsk.exe Skcsk.exe PID 796 wrote to memory of 1772 796 Skcsk.exe Skcsk.exe PID 796 wrote to memory of 1772 796 Skcsk.exe Skcsk.exe PID 796 wrote to memory of 1772 796 Skcsk.exe Skcsk.exe PID 588 wrote to memory of 1892 588 cmd.exe PING.EXE PID 588 wrote to memory of 1892 588 cmd.exe PING.EXE PID 588 wrote to memory of 1892 588 cmd.exe PING.EXE PID 588 wrote to memory of 1892 588 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c.exe"C:\Users\Admin\AppData\Local\Temp\1993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\1993B1~1.EXE > nul2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\Skcsk.exeC:\Windows\SysWOW64\Skcsk.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Skcsk.exeC:\Windows\SysWOW64\Skcsk.exe -acsi2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Skcsk.exeFilesize
840KB
MD529134e6a1688ce88edf31e1146be282d
SHA15aea9e4de2a42900f26304bab5cf1dc6954dfc41
SHA2561993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c
SHA5129b3baba119241a7ea0fd5671ab5a967fd347b2cbb09eb90e9f63e945daae0254fce9dcf020ab035cc1f481033a0ca9cf298a7b043b96f7b65c9fd83445876a2a
-
C:\Windows\SysWOW64\Skcsk.exeFilesize
840KB
MD529134e6a1688ce88edf31e1146be282d
SHA15aea9e4de2a42900f26304bab5cf1dc6954dfc41
SHA2561993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c
SHA5129b3baba119241a7ea0fd5671ab5a967fd347b2cbb09eb90e9f63e945daae0254fce9dcf020ab035cc1f481033a0ca9cf298a7b043b96f7b65c9fd83445876a2a
-
C:\Windows\SysWOW64\Skcsk.exeFilesize
840KB
MD529134e6a1688ce88edf31e1146be282d
SHA15aea9e4de2a42900f26304bab5cf1dc6954dfc41
SHA2561993b188bfa89dca45d1db1e55d6af3c68aa24236366c84ae82320690c4f9f5c
SHA5129b3baba119241a7ea0fd5671ab5a967fd347b2cbb09eb90e9f63e945daae0254fce9dcf020ab035cc1f481033a0ca9cf298a7b043b96f7b65c9fd83445876a2a
-
memory/796-72-0x0000000000400000-0x00000000005CA8A1-memory.dmpFilesize
1.8MB
-
memory/796-75-0x0000000000400000-0x00000000005CA8A1-memory.dmpFilesize
1.8MB
-
memory/1772-76-0x0000000010000000-0x00000000101A0000-memory.dmpFilesize
1.6MB
-
memory/1772-83-0x0000000000400000-0x00000000005CA8A1-memory.dmpFilesize
1.8MB
-
memory/1772-84-0x0000000000210000-0x0000000000212000-memory.dmpFilesize
8KB
-
memory/2000-54-0x0000000010000000-0x00000000101A0000-memory.dmpFilesize
1.6MB
-
memory/2000-62-0x0000000000400000-0x00000000005CA8A1-memory.dmpFilesize
1.8MB
-
memory/2000-63-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/2000-73-0x0000000000400000-0x00000000005CA8A1-memory.dmpFilesize
1.8MB