Analysis
-
max time kernel
0s -
max time network
6s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 14:30
General
-
Target
dab7b1931e1fd1d7446465e67e06596969a613e81a598c895a847e9a80b98ce7.exe
-
Size
628KB
-
MD5
342cbc79e5daf07179604321dbfbb456
-
SHA1
73734b1523d83d61b9883b797476d4a164f7cb07
-
SHA256
dab7b1931e1fd1d7446465e67e06596969a613e81a598c895a847e9a80b98ce7
-
SHA512
28a3fb2e249340b171575c978f8dad622277cefdfedccf6d1b51b0923198e3a1a3461f155c5c6862673c39fa0737d3f2cd22ba7a3a8ed36971d359f280153126
-
SSDEEP
12288:WhymnwJFPNdgBAEHApqePJN1AmLM7uVq9sS0yun4txyzF:WUmwrl2Ao7sJNlM7ymsS0Zn4txyzF
Malware Config
Signatures
-
Detect PurpleFox Rootkit 1 IoCs
Detect PurpleFox Rootkit.
-
Gh0st RAT payload 1 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Runs ping.exe 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dab7b1931e1fd1d7446465e67e06596969a613e81a598c895a847e9a80b98ce7.exe"C:\Users\Admin\AppData\Local\Temp\dab7b1931e1fd1d7446465e67e06596969a613e81a598c895a847e9a80b98ce7.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\DAB7B1~1.EXE > nul2⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.11⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\Sys.exeC:\Windows\SysWOW64\Sys.exe -acsi1⤵
-
C:\Windows\SysWOW64\Sys.exeC:\Windows\SysWOW64\Sys.exe -auto1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.6MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.6MB
-
Filesize
1.4MB