Analysis
-
max time kernel
142s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
28/08/2023, 16:45
Static task
static1
Behavioral task
behavioral1
Sample
4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe
Resource
win7-20230712-en
General
-
Target
4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe
-
Size
491KB
-
MD5
7da8e9785dde7832556c818c816bb839
-
SHA1
d124bfe64ff733660df4749be24a6d110fb5e306
-
SHA256
4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68
-
SHA512
5baf9ec62e12625a4e986942ea33e604ad7251468ae666ec3857e08acb4ed3f126c885a46948f5360eb9db62350bd65b4449cba49e761c21afda705e0055fc43
-
SSDEEP
6144:E7wYNaSqy7WvCH0WYMzhExyNsbYiE17RzkmTldDwDdD+6kAT037IPe0ymqLaR56X:igV6WvCzhsEpJzWd7kFx0ymov
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2908-2-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/2908-4-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/2908-5-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/2908-11-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/2936-16-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/2936-17-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/2936-23-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/2852-26-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/2852-27-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/2852-31-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 10 IoCs
resource yara_rule behavioral1/memory/2908-2-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/2908-4-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/2908-5-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/2908-11-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/2936-16-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/2936-17-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/2936-23-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/2852-26-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/2852-27-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/2852-31-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat -
Deletes itself 1 IoCs
pid Process 2500 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2936 Jqiyq.exe 2852 Jqiyq.exe -
Loads dropped DLL 1 IoCs
pid Process 2936 Jqiyq.exe -
resource yara_rule behavioral1/memory/2908-0-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2908-2-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2908-3-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2908-4-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2908-5-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2908-11-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2936-16-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2936-17-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2936-23-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2852-26-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2852-27-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2852-31-0x0000000010000000-0x00000000101D0000-memory.dmp upx -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: Jqiyq.exe File opened (read-only) \??\L: Jqiyq.exe File opened (read-only) \??\P: Jqiyq.exe File opened (read-only) \??\R: Jqiyq.exe File opened (read-only) \??\W: Jqiyq.exe File opened (read-only) \??\Z: Jqiyq.exe File opened (read-only) \??\M: Jqiyq.exe File opened (read-only) \??\Q: Jqiyq.exe File opened (read-only) \??\S: Jqiyq.exe File opened (read-only) \??\T: Jqiyq.exe File opened (read-only) \??\U: Jqiyq.exe File opened (read-only) \??\V: Jqiyq.exe File opened (read-only) \??\B: Jqiyq.exe File opened (read-only) \??\E: Jqiyq.exe File opened (read-only) \??\I: Jqiyq.exe File opened (read-only) \??\J: Jqiyq.exe File opened (read-only) \??\N: Jqiyq.exe File opened (read-only) \??\O: Jqiyq.exe File opened (read-only) \??\H: Jqiyq.exe File opened (read-only) \??\K: Jqiyq.exe File opened (read-only) \??\X: Jqiyq.exe File opened (read-only) \??\Y: Jqiyq.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Jqiyq.exe 4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe File opened for modification C:\Program Files\Jqiyq.exe 4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe -
Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Jqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software Jqiyq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft Jqiyq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie Jqiyq.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum Jqiyq.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" Jqiyq.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2768 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe 2852 Jqiyq.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2908 4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2852 2936 Jqiyq.exe 30 PID 2936 wrote to memory of 2852 2936 Jqiyq.exe 30 PID 2936 wrote to memory of 2852 2936 Jqiyq.exe 30 PID 2936 wrote to memory of 2852 2936 Jqiyq.exe 30 PID 2908 wrote to memory of 2500 2908 4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe 29 PID 2908 wrote to memory of 2500 2908 4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe 29 PID 2908 wrote to memory of 2500 2908 4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe 29 PID 2908 wrote to memory of 2500 2908 4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe 29 PID 2500 wrote to memory of 2768 2500 cmd.exe 32 PID 2500 wrote to memory of 2768 2500 cmd.exe 32 PID 2500 wrote to memory of 2768 2500 cmd.exe 32 PID 2500 wrote to memory of 2768 2500 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe"C:\Users\Admin\AppData\Local\Temp\4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\4FD32A~1.EXE > nul2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:2768
-
-
-
C:\Program Files\Jqiyq.exe"C:\Program Files\Jqiyq.exe" -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Program Files\Jqiyq.exe"C:\Program Files\Jqiyq.exe" -acsi2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100.5MB
MD53bdd413553f7cf7a568a35531a3416b7
SHA10f8fa257444824115d554c40afbb9727927a8402
SHA2569cafb943a483e5e5699821cac8e11cfe0db0bbf9086cb6fbd4f69afc69af5686
SHA512e5d2ec3d82129789b08370ef016df00879df0a90b43cac180224f880f80adaa5e6f6d1b2e8e3c18a5368259730f522bd9874f803e2ea14acb94449d4ffc486d0
-
Filesize
100.5MB
MD53bdd413553f7cf7a568a35531a3416b7
SHA10f8fa257444824115d554c40afbb9727927a8402
SHA2569cafb943a483e5e5699821cac8e11cfe0db0bbf9086cb6fbd4f69afc69af5686
SHA512e5d2ec3d82129789b08370ef016df00879df0a90b43cac180224f880f80adaa5e6f6d1b2e8e3c18a5368259730f522bd9874f803e2ea14acb94449d4ffc486d0
-
Filesize
100.5MB
MD53bdd413553f7cf7a568a35531a3416b7
SHA10f8fa257444824115d554c40afbb9727927a8402
SHA2569cafb943a483e5e5699821cac8e11cfe0db0bbf9086cb6fbd4f69afc69af5686
SHA512e5d2ec3d82129789b08370ef016df00879df0a90b43cac180224f880f80adaa5e6f6d1b2e8e3c18a5368259730f522bd9874f803e2ea14acb94449d4ffc486d0
-
Filesize
100.5MB
MD53bdd413553f7cf7a568a35531a3416b7
SHA10f8fa257444824115d554c40afbb9727927a8402
SHA2569cafb943a483e5e5699821cac8e11cfe0db0bbf9086cb6fbd4f69afc69af5686
SHA512e5d2ec3d82129789b08370ef016df00879df0a90b43cac180224f880f80adaa5e6f6d1b2e8e3c18a5368259730f522bd9874f803e2ea14acb94449d4ffc486d0