Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2023, 23:51

General

  • Target

    0575c396843f6701ad18dcb27fa352e9cfe8d85bebd3507e019a343223038ca1.exe

  • Size

    650KB

  • MD5

    6d72ac00f34dbfb96c0d0db01248d409

  • SHA1

    43c0b5e6c8d718aa8c4b654108e9cd8706933c0e

  • SHA256

    0575c396843f6701ad18dcb27fa352e9cfe8d85bebd3507e019a343223038ca1

  • SHA512

    893e028383e7bce049d45a1a3c495a0e374a0f541393e1dda9275e4794e9e058169c8027e6374cd60281d71ecf71da809a96bbf75ccf12afa0ef63982439af13

  • SSDEEP

    12288:mutTZV/qb9ylN28aE2GThX8xb8paF/4esnMzIiTe:BNZEbCfCGTqxdF/IViTe

Malware Config

Signatures

  • Detect PurpleFox Rootkit 8 IoCs

    Detect PurpleFox Rootkit.

  • Gh0st RAT payload 10 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0575c396843f6701ad18dcb27fa352e9cfe8d85bebd3507e019a343223038ca1.exe
    "C:\Users\Admin\AppData\Local\Temp\0575c396843f6701ad18dcb27fa352e9cfe8d85bebd3507e019a343223038ca1.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\0575C3~1.EXE > nul
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:1520
      • C:\Windows\SysWOW64\PING.EXE
        ping -n 2 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:2196
  • C:\Windows\SysWOW64\Jbcdt.exe
    C:\Windows\SysWOW64\Jbcdt.exe -auto
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Windows\SysWOW64\Jbcdt.exe
      C:\Windows\SysWOW64\Jbcdt.exe -acsi
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Executes dropped EXE
      • Suspicious behavior: LoadsDriver
      • Suspicious use of AdjustPrivilegeToken
      PID:1440

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\Jbcdt.exe

          Filesize

          2.6MB

          MD5

          1621e7cc411c8a27adad7fd2afe1485c

          SHA1

          41c07add4edf52b22416b20904edc2ef315d2397

          SHA256

          21e07fac3743ecd6a33b6b2e1521e1852884281e833f8bead4b046f87aef4a49

          SHA512

          0de1b4590744dc10ffec2dc6183469805485f37ba3ccf2f0102b04c27546e3ee260b9c63062f895122365c36df2203f792f6b5f24d5e590a402fbbe43124e7e2

        • C:\Windows\SysWOW64\Jbcdt.exe

          Filesize

          2.6MB

          MD5

          1621e7cc411c8a27adad7fd2afe1485c

          SHA1

          41c07add4edf52b22416b20904edc2ef315d2397

          SHA256

          21e07fac3743ecd6a33b6b2e1521e1852884281e833f8bead4b046f87aef4a49

          SHA512

          0de1b4590744dc10ffec2dc6183469805485f37ba3ccf2f0102b04c27546e3ee260b9c63062f895122365c36df2203f792f6b5f24d5e590a402fbbe43124e7e2

        • C:\Windows\SysWOW64\Jbcdt.exe

          Filesize

          2.6MB

          MD5

          1621e7cc411c8a27adad7fd2afe1485c

          SHA1

          41c07add4edf52b22416b20904edc2ef315d2397

          SHA256

          21e07fac3743ecd6a33b6b2e1521e1852884281e833f8bead4b046f87aef4a49

          SHA512

          0de1b4590744dc10ffec2dc6183469805485f37ba3ccf2f0102b04c27546e3ee260b9c63062f895122365c36df2203f792f6b5f24d5e590a402fbbe43124e7e2

        • \Windows\SysWOW64\Jbcdt.exe

          Filesize

          2.6MB

          MD5

          1621e7cc411c8a27adad7fd2afe1485c

          SHA1

          41c07add4edf52b22416b20904edc2ef315d2397

          SHA256

          21e07fac3743ecd6a33b6b2e1521e1852884281e833f8bead4b046f87aef4a49

          SHA512

          0de1b4590744dc10ffec2dc6183469805485f37ba3ccf2f0102b04c27546e3ee260b9c63062f895122365c36df2203f792f6b5f24d5e590a402fbbe43124e7e2

        • memory/1440-76-0x0000000010000000-0x00000000101BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1440-82-0x0000000010000000-0x00000000101BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1440-80-0x0000000010000000-0x00000000101BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1440-77-0x0000000010000000-0x00000000101BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1876-65-0x0000000010000000-0x00000000101BA000-memory.dmp

          Filesize

          1.7MB

        • memory/1876-73-0x0000000010000000-0x00000000101BA000-memory.dmp

          Filesize

          1.7MB

        • memory/2676-57-0x0000000010000000-0x00000000101BA000-memory.dmp

          Filesize

          1.7MB

        • memory/2676-71-0x0000000010000000-0x00000000101BA000-memory.dmp

          Filesize

          1.7MB

        • memory/2676-53-0x0000000010000000-0x00000000101BA000-memory.dmp

          Filesize

          1.7MB

        • memory/2676-56-0x0000000010000000-0x00000000101BA000-memory.dmp

          Filesize

          1.7MB

        • memory/2676-55-0x0000000010000000-0x00000000101BA000-memory.dmp

          Filesize

          1.7MB