Analysis
-
max time kernel
141s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 16:45
Static task
static1
Behavioral task
behavioral1
Sample
4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe
Resource
win7-20230712-en
General
-
Target
4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe
-
Size
491KB
-
MD5
7da8e9785dde7832556c818c816bb839
-
SHA1
d124bfe64ff733660df4749be24a6d110fb5e306
-
SHA256
4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68
-
SHA512
5baf9ec62e12625a4e986942ea33e604ad7251468ae666ec3857e08acb4ed3f126c885a46948f5360eb9db62350bd65b4449cba49e761c21afda705e0055fc43
-
SSDEEP
6144:E7wYNaSqy7WvCH0WYMzhExyNsbYiE17RzkmTldDwDdD+6kAT037IPe0ymqLaR56X:igV6WvCzhsEpJzWd7kFx0ymov
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/372-5-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/372-4-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/372-3-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/372-6-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/1796-15-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/1796-16-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/1796-17-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/1796-18-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/372-19-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/1796-23-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/4688-26-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/4688-27-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/4688-31-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/4688-32-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 15 IoCs
resource yara_rule behavioral2/memory/372-5-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/372-4-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/372-3-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/372-6-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/1796-15-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/1796-16-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/1796-17-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/1796-14-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/1796-18-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/372-19-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/1796-23-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/4688-26-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/4688-27-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/4688-31-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/4688-32-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat -
Executes dropped EXE 2 IoCs
pid Process 1796 Jqiyq.exe 4688 Jqiyq.exe -
resource yara_rule behavioral2/memory/372-0-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/372-5-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/372-4-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/372-3-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/372-6-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/1796-12-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/1796-15-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/1796-16-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/1796-17-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/1796-14-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/1796-18-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/372-19-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/1796-23-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/4688-26-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/4688-27-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/4688-31-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/4688-32-0x0000000010000000-0x00000000101D0000-memory.dmp upx -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: Jqiyq.exe File opened (read-only) \??\L: Jqiyq.exe File opened (read-only) \??\P: Jqiyq.exe File opened (read-only) \??\V: Jqiyq.exe File opened (read-only) \??\K: Jqiyq.exe File opened (read-only) \??\U: Jqiyq.exe File opened (read-only) \??\X: Jqiyq.exe File opened (read-only) \??\G: Jqiyq.exe File opened (read-only) \??\J: Jqiyq.exe File opened (read-only) \??\N: Jqiyq.exe File opened (read-only) \??\T: Jqiyq.exe File opened (read-only) \??\W: Jqiyq.exe File opened (read-only) \??\Q: Jqiyq.exe File opened (read-only) \??\R: Jqiyq.exe File opened (read-only) \??\S: Jqiyq.exe File opened (read-only) \??\E: Jqiyq.exe File opened (read-only) \??\H: Jqiyq.exe File opened (read-only) \??\I: Jqiyq.exe File opened (read-only) \??\M: Jqiyq.exe File opened (read-only) \??\O: Jqiyq.exe File opened (read-only) \??\Y: Jqiyq.exe File opened (read-only) \??\Z: Jqiyq.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Jqiyq.exe 4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe File opened for modification C:\Program Files\Jqiyq.exe 4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Jqiyq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Jqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Jqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software Jqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Jqiyq.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3720 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe 4688 Jqiyq.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 372 4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 372 wrote to memory of 2028 372 4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe 87 PID 372 wrote to memory of 2028 372 4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe 87 PID 372 wrote to memory of 2028 372 4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe 87 PID 1796 wrote to memory of 4688 1796 Jqiyq.exe 89 PID 1796 wrote to memory of 4688 1796 Jqiyq.exe 89 PID 1796 wrote to memory of 4688 1796 Jqiyq.exe 89 PID 2028 wrote to memory of 3720 2028 cmd.exe 92 PID 2028 wrote to memory of 3720 2028 cmd.exe 92 PID 2028 wrote to memory of 3720 2028 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe"C:\Users\Admin\AppData\Local\Temp\4fd32aa955aa9bd3a33ca8771445822be3b55d53e04d5e6fa40b0cbaa354bf68.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\4FD32A~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:3720
-
-
-
C:\Program Files\Jqiyq.exe"C:\Program Files\Jqiyq.exe" -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files\Jqiyq.exe"C:\Program Files\Jqiyq.exe" -acsi2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100.5MB
MD53bdd413553f7cf7a568a35531a3416b7
SHA10f8fa257444824115d554c40afbb9727927a8402
SHA2569cafb943a483e5e5699821cac8e11cfe0db0bbf9086cb6fbd4f69afc69af5686
SHA512e5d2ec3d82129789b08370ef016df00879df0a90b43cac180224f880f80adaa5e6f6d1b2e8e3c18a5368259730f522bd9874f803e2ea14acb94449d4ffc486d0
-
Filesize
100.5MB
MD53bdd413553f7cf7a568a35531a3416b7
SHA10f8fa257444824115d554c40afbb9727927a8402
SHA2569cafb943a483e5e5699821cac8e11cfe0db0bbf9086cb6fbd4f69afc69af5686
SHA512e5d2ec3d82129789b08370ef016df00879df0a90b43cac180224f880f80adaa5e6f6d1b2e8e3c18a5368259730f522bd9874f803e2ea14acb94449d4ffc486d0
-
Filesize
100.5MB
MD53bdd413553f7cf7a568a35531a3416b7
SHA10f8fa257444824115d554c40afbb9727927a8402
SHA2569cafb943a483e5e5699821cac8e11cfe0db0bbf9086cb6fbd4f69afc69af5686
SHA512e5d2ec3d82129789b08370ef016df00879df0a90b43cac180224f880f80adaa5e6f6d1b2e8e3c18a5368259730f522bd9874f803e2ea14acb94449d4ffc486d0