Analysis

  • max time kernel
    141s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    25-08-2023 04:01

General

  • Target

    WPS_Installer_.exe

  • Size

    4.1MB

  • MD5

    6e2cde27cf0f6d43d92687a13aef3980

  • SHA1

    c35a49b96c283ed47e1d80153b76dffc5d296286

  • SHA256

    fd6eb81590d22d47002590865955daa2ed559be1e9805099c59f5cb74a788c58

  • SHA512

    3a735cd61335547a11d6290ad34f3be7c012f6020dc991ccfd733e46e747ac36649a07b5cbfbf9fadf7d357adb93d2520de46fe3193e8df27645121011d55f22

  • SSDEEP

    98304:QSBIC1oZLORr1CjckI7d3bajae4Q+65q49HwWkFoLE3L:5CfONJTOuFQq45WKL6

Malware Config

Signatures

  • Detect PurpleFox Rootkit 1 IoCs

    Detect PurpleFox Rootkit.

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WPS_Installer_.exe
    "C:\Users\Admin\AppData\Local\Temp\WPS_Installer_.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Users\Admin\AppData\Local\Temp\dahaima\WPS_Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\dahaima\WPS_Installer.exe"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      PID:2972
    • C:\Users\Admin\AppData\Local\Temp\dahaima\dahai.exe
      "C:\Users\Admin\AppData\Local\Temp\dahaima\dahai.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2880

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dahaima\WPS_Installer.exe

    Filesize

    2.9MB

    MD5

    b52ba2b99108c496389ae5bb81fa6537

    SHA1

    9073d8c4a1968be24357862015519f2afecd833a

    SHA256

    c6ac7d9add40b913112b265d4f366d9ef80bbd711049db085fc750fcad4e14d8

    SHA512

    6637506ee80d359e729e0011b97e8d827e14356393193247f502b7fcfbbca249dc045b8acfe4b31ce462468f421dc5d9a4e31183bedb66c45a9aa43c01f81397

  • C:\Users\Admin\AppData\Local\Temp\dahaima\WPS_Installer.exe

    Filesize

    2.9MB

    MD5

    b52ba2b99108c496389ae5bb81fa6537

    SHA1

    9073d8c4a1968be24357862015519f2afecd833a

    SHA256

    c6ac7d9add40b913112b265d4f366d9ef80bbd711049db085fc750fcad4e14d8

    SHA512

    6637506ee80d359e729e0011b97e8d827e14356393193247f502b7fcfbbca249dc045b8acfe4b31ce462468f421dc5d9a4e31183bedb66c45a9aa43c01f81397

  • C:\Users\Admin\AppData\Local\Temp\dahaima\WPS_Installer.exe

    Filesize

    2.9MB

    MD5

    b52ba2b99108c496389ae5bb81fa6537

    SHA1

    9073d8c4a1968be24357862015519f2afecd833a

    SHA256

    c6ac7d9add40b913112b265d4f366d9ef80bbd711049db085fc750fcad4e14d8

    SHA512

    6637506ee80d359e729e0011b97e8d827e14356393193247f502b7fcfbbca249dc045b8acfe4b31ce462468f421dc5d9a4e31183bedb66c45a9aa43c01f81397

  • C:\Users\Admin\AppData\Local\Temp\dahaima\dahai.exe

    Filesize

    1.6MB

    MD5

    174895d7e1a751397f161a785fb1b355

    SHA1

    27a56118d233adc9adcaaad95bedb0c8862c5277

    SHA256

    2609445b23bf24267c6c5b597d78a8cfedecde62fb5c567436829ecbce95d743

    SHA512

    2e9d5b7d247c9c2b3c38c4aecad08e217e2de7e3042c3eb67fb40e49c87c1709eeaec93119bbf4ea17464a75e8d1191795afbedc4f6bb62418a7619489df4d75

  • \Users\Admin\AppData\Local\Temp\dahaima\WPS_Installer.exe

    Filesize

    2.9MB

    MD5

    b52ba2b99108c496389ae5bb81fa6537

    SHA1

    9073d8c4a1968be24357862015519f2afecd833a

    SHA256

    c6ac7d9add40b913112b265d4f366d9ef80bbd711049db085fc750fcad4e14d8

    SHA512

    6637506ee80d359e729e0011b97e8d827e14356393193247f502b7fcfbbca249dc045b8acfe4b31ce462468f421dc5d9a4e31183bedb66c45a9aa43c01f81397

  • \Users\Admin\AppData\Local\Temp\dahaima\dahai.exe

    Filesize

    1.6MB

    MD5

    174895d7e1a751397f161a785fb1b355

    SHA1

    27a56118d233adc9adcaaad95bedb0c8862c5277

    SHA256

    2609445b23bf24267c6c5b597d78a8cfedecde62fb5c567436829ecbce95d743

    SHA512

    2e9d5b7d247c9c2b3c38c4aecad08e217e2de7e3042c3eb67fb40e49c87c1709eeaec93119bbf4ea17464a75e8d1191795afbedc4f6bb62418a7619489df4d75

  • memory/2064-15-0x0000000003800000-0x0000000003DA3000-memory.dmp

    Filesize

    5.6MB

  • memory/2064-22-0x0000000000400000-0x000000000050A000-memory.dmp

    Filesize

    1.0MB

  • memory/2064-0-0x0000000000400000-0x000000000050A000-memory.dmp

    Filesize

    1.0MB

  • memory/2880-33-0x0000000010000000-0x0000000010199000-memory.dmp

    Filesize

    1.6MB

  • memory/2972-41-0x0000000000230000-0x00000000007D3000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-61-0x0000000000230000-0x00000000007D3000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-17-0x0000000000230000-0x00000000007D3000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-42-0x0000000000230000-0x00000000007D3000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-43-0x0000000000230000-0x00000000007D3000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-50-0x0000000000230000-0x00000000007D3000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-60-0x0000000000230000-0x00000000007D3000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-31-0x0000000000230000-0x00000000007D3000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-62-0x0000000000230000-0x00000000007D3000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-63-0x0000000000230000-0x00000000007D3000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-64-0x0000000000230000-0x00000000007D3000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-65-0x0000000000230000-0x00000000007D3000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-66-0x0000000000230000-0x00000000007D3000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-67-0x0000000000230000-0x00000000007D3000-memory.dmp

    Filesize

    5.6MB

  • memory/2972-68-0x0000000000230000-0x00000000007D3000-memory.dmp

    Filesize

    5.6MB