Analysis
- max time kernel
179s - max time network
187s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system - submitted
07/10/2023, 23:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d2e1951940ce8fa8edd3354109231fe25eaaac03f5ab2ce92ffd94aa3c1a162.exe
Resource
win7-20230831-en
windows7-x64
15 signatures
150 seconds
General
- Target 4d2e1951940ce8fa8edd3354109231fe25eaaac03f5ab2ce92ffd94aa3c1a162.exe
- Size 491KB
- Sample231007-3vbcasgd8s
- SHA256 4d2e1951940ce8fa8edd3354109231fe25eaaac03f5ab2ce92ffd94aa3c1a162
- MD5 7a68606206cfdf2e7f555079d73f4e5e
- SHA1 e57a65fd14c2cc1acd6c299f3bc1845ef8119c1f
- SHA512 b733c387b4581bd60b309bece0e87de246bde7d72206aae70483f1198541fd850b17bdfbd3c21ad065ec2392a3c0cc78a90ccea01fc4f1900cce1328d06be827
- SSDEEP 6144:E7wYNaSqy7WvCH0WYMzhExyNsbYiE17RzkmTldDwDdD+6kAT037IPe0ymqLaRK6X:igV6WvCzhsEpJzWd7kFx0ymTv
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1372-3-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/1372-4-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/1372-5-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/1372-6-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/2572-16-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/2572-14-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/2572-17-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/2572-18-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/1372-19-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/2572-21-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/2760-25-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/2760-26-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/2760-27-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/2760-28-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/2760-32-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit - Gh0st RAT payload 16 IoCs
resource yara_rule behavioral2/memory/1372-3-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/1372-4-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/1372-5-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/1372-6-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/2572-15-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/2572-16-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/2572-14-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/2572-17-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/2572-18-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/1372-19-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/2572-21-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/2760-25-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/2760-26-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/2760-27-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/2760-28-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/2760-32-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat - Executes dropped EXE 2 IoCs
pid Process 2572 Jqiyq.exe 2760 Jqiyq.exe -
resource yara_rule behavioral2/memory/1372-0-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/1372-3-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/1372-4-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/1372-5-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/1372-6-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2572-12-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2572-15-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2572-16-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2572-14-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2572-17-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2572-18-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/1372-19-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2572-21-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2760-22-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2760-25-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2760-26-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2760-27-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2760-28-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2760-32-0x0000000010000000-0x00000000101D0000-memory.dmp upx - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Jqiyq.exe File opened (read-only) \??\V: Jqiyq.exe File opened (read-only) \??\B: Jqiyq.exe File opened (read-only) \??\M: Jqiyq.exe File opened (read-only) \??\O: Jqiyq.exe File opened (read-only) \??\U: Jqiyq.exe File opened (read-only) \??\X: Jqiyq.exe File opened (read-only) \??\Y: Jqiyq.exe File opened (read-only) \??\E: Jqiyq.exe File opened (read-only) \??\N: Jqiyq.exe File opened (read-only) \??\S: Jqiyq.exe File opened (read-only) \??\T: Jqiyq.exe File opened (read-only) \??\W: Jqiyq.exe File opened (read-only) \??\Z: Jqiyq.exe File opened (read-only) \??\G: Jqiyq.exe File opened (read-only) \??\J: Jqiyq.exe File opened (read-only) \??\K: Jqiyq.exe File opened (read-only) \??\Q: Jqiyq.exe File opened (read-only) \??\R: Jqiyq.exe File opened (read-only) \??\H: Jqiyq.exe File opened (read-only) \??\I: Jqiyq.exe File opened (read-only) \??\L: Jqiyq.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Jqiyq.exe 4d2e1951940ce8fa8edd3354109231fe25eaaac03f5ab2ce92ffd94aa3c1a162.exe File opened for modification C:\Program Files\Jqiyq.exe 4d2e1951940ce8fa8edd3354109231fe25eaaac03f5ab2ce92ffd94aa3c1a162.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jqiyq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Jqiyq.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software Jqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Jqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Jqiyq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Jqiyq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Jqiyq.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 2568 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe 2760 Jqiyq.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1372 4d2e1951940ce8fa8edd3354109231fe25eaaac03f5ab2ce92ffd94aa3c1a162.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1372 wrote to memory of 3768 1372 4d2e1951940ce8fa8edd3354109231fe25eaaac03f5ab2ce92ffd94aa3c1a162.exe 89 PID 1372 wrote to memory of 3768 1372 4d2e1951940ce8fa8edd3354109231fe25eaaac03f5ab2ce92ffd94aa3c1a162.exe 89 PID 1372 wrote to memory of 3768 1372 4d2e1951940ce8fa8edd3354109231fe25eaaac03f5ab2ce92ffd94aa3c1a162.exe 89 PID 2572 wrote to memory of 2760 2572 Jqiyq.exe 90 PID 2572 wrote to memory of 2760 2572 Jqiyq.exe 90 PID 2572 wrote to memory of 2760 2572 Jqiyq.exe 90 PID 3768 wrote to memory of 2568 3768 cmd.exe 92 PID 3768 wrote to memory of 2568 3768 cmd.exe 92 PID 3768 wrote to memory of 2568 3768 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d2e1951940ce8fa8edd3354109231fe25eaaac03f5ab2ce92ffd94aa3c1a162.exe"C:\Users\Admin\AppData\Local\Temp\4d2e1951940ce8fa8edd3354109231fe25eaaac03f5ab2ce92ffd94aa3c1a162.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\4D2E19~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:2568
-
-
-
C:\Program Files\Jqiyq.exe"C:\Program Files\Jqiyq.exe" -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Program Files\Jqiyq.exe"C:\Program Files\Jqiyq.exe" -acsi2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Jqiyq.exe
- Size 1.5MB
- SHA256 aec02c237892ce1ce4a13a0472099b286b5ad84d95be7d06a77b491c88ab61b7
- MD5 d27847f3694ad2f092ab8e58b0a64cc9
- SHA1 0a99ce4c5d8c29e1b3958b9dd24a0a4041d9fc0b
- SHA512 31652b19c9b88092eece319290c078dab64ecd5c58e9abcb2ffef8125d26ece2f81e5ad08ca4431d5f78d1630beb5a19d06feb261caad93c7bf4d1b815e9cb46
- SSDEEP 6144:E7wYNaSqy7WvCH0WYMzhExyNsbYiE17RzkmTldDwDdD+6kAT037IPe0ymqLaRK6s:igV6WvCzhsEpJzWd7kFx0ymTv8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Jqiyq.exe
- Size 1.5MB
- SHA256 aec02c237892ce1ce4a13a0472099b286b5ad84d95be7d06a77b491c88ab61b7
- MD5 d27847f3694ad2f092ab8e58b0a64cc9
- SHA1 0a99ce4c5d8c29e1b3958b9dd24a0a4041d9fc0b
- SHA512 31652b19c9b88092eece319290c078dab64ecd5c58e9abcb2ffef8125d26ece2f81e5ad08ca4431d5f78d1630beb5a19d06feb261caad93c7bf4d1b815e9cb46
- SSDEEP 6144:E7wYNaSqy7WvCH0WYMzhExyNsbYiE17RzkmTldDwDdD+6kAT037IPe0ymqLaRK6s:igV6WvCzhsEpJzWd7kFx0ymTv8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Jqiyq.exe
- Size 1.5MB
- SHA256 aec02c237892ce1ce4a13a0472099b286b5ad84d95be7d06a77b491c88ab61b7
- MD5 d27847f3694ad2f092ab8e58b0a64cc9
- SHA1 0a99ce4c5d8c29e1b3958b9dd24a0a4041d9fc0b
- SHA512 31652b19c9b88092eece319290c078dab64ecd5c58e9abcb2ffef8125d26ece2f81e5ad08ca4431d5f78d1630beb5a19d06feb261caad93c7bf4d1b815e9cb46
- SSDEEP 6144:E7wYNaSqy7WvCH0WYMzhExyNsbYiE17RzkmTldDwDdD+6kAT037IPe0ymqLaRK6s:igV6WvCzhsEpJzWd7kFx0ymTv8
- MD5 SHA1 SHA512 SSDEEP