Analysis
-
max time kernel
130s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/03/2024, 03:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2652af0408b5a088c9992b23774063d6185003031c00942c1e0b40a4ff1d4a07.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
General
-
Target
2652af0408b5a088c9992b23774063d6185003031c00942c1e0b40a4ff1d4a07.exe
-
Size
688KB
-
MD5
066ff45d0b248d7beba5458dfa2dbfc7
-
SHA1
8af45fd44fa59a0f70edcafe54435458aa3c5545
-
SHA256
2652af0408b5a088c9992b23774063d6185003031c00942c1e0b40a4ff1d4a07
-
SHA512
f9437e4b9e4b659d5c06ef70027e9b10d4a092a9a7ad9f0ed26f54c4f0caacfc83688c7d172b8c04278455e5563389013dd02c6281e3f50901ba6d81647443fc
-
SSDEEP
12288:7MPDpqEhsPAxJTDjfsggWxAc90bdMDt0AQk:7MPtqEhT6WdebdG06
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2244-4-0x0000000010000000-0x00000000101B8000-memory.dmp purplefox_rootkit behavioral1/memory/2244-3-0x0000000010000000-0x00000000101B8000-memory.dmp purplefox_rootkit behavioral1/memory/2868-15-0x0000000010000000-0x00000000101B8000-memory.dmp purplefox_rootkit behavioral1/memory/2244-14-0x0000000010000000-0x00000000101B8000-memory.dmp purplefox_rootkit behavioral1/memory/2656-18-0x0000000010000000-0x00000000101B8000-memory.dmp purplefox_rootkit behavioral1/memory/2656-20-0x0000000010000000-0x00000000101B8000-memory.dmp purplefox_rootkit behavioral1/memory/2656-21-0x0000000010000000-0x00000000101B8000-memory.dmp purplefox_rootkit behavioral1/memory/2656-24-0x0000000010000000-0x00000000101B8000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 8 IoCs
resource yara_rule behavioral1/memory/2244-4-0x0000000010000000-0x00000000101B8000-memory.dmp family_gh0strat behavioral1/memory/2244-3-0x0000000010000000-0x00000000101B8000-memory.dmp family_gh0strat behavioral1/memory/2868-15-0x0000000010000000-0x00000000101B8000-memory.dmp family_gh0strat behavioral1/memory/2244-14-0x0000000010000000-0x00000000101B8000-memory.dmp family_gh0strat behavioral1/memory/2656-18-0x0000000010000000-0x00000000101B8000-memory.dmp family_gh0strat behavioral1/memory/2656-20-0x0000000010000000-0x00000000101B8000-memory.dmp family_gh0strat behavioral1/memory/2656-21-0x0000000010000000-0x00000000101B8000-memory.dmp family_gh0strat behavioral1/memory/2656-24-0x0000000010000000-0x00000000101B8000-memory.dmp family_gh0strat -
Deletes itself 1 IoCs
pid Process 2640 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2868 Tkctk.exe 2656 Tkctk.exe -
resource yara_rule behavioral1/memory/2244-0-0x0000000010000000-0x00000000101B8000-memory.dmp upx behavioral1/memory/2244-4-0x0000000010000000-0x00000000101B8000-memory.dmp upx behavioral1/memory/2244-3-0x0000000010000000-0x00000000101B8000-memory.dmp upx behavioral1/memory/2868-15-0x0000000010000000-0x00000000101B8000-memory.dmp upx behavioral1/memory/2244-14-0x0000000010000000-0x00000000101B8000-memory.dmp upx behavioral1/memory/2656-16-0x0000000010000000-0x00000000101B8000-memory.dmp upx behavioral1/memory/2656-18-0x0000000010000000-0x00000000101B8000-memory.dmp upx behavioral1/memory/2656-20-0x0000000010000000-0x00000000101B8000-memory.dmp upx behavioral1/memory/2656-21-0x0000000010000000-0x00000000101B8000-memory.dmp upx behavioral1/memory/2656-24-0x0000000010000000-0x00000000101B8000-memory.dmp upx -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Tkctk.exe File opened (read-only) \??\J: Tkctk.exe File opened (read-only) \??\N: Tkctk.exe File opened (read-only) \??\O: Tkctk.exe File opened (read-only) \??\R: Tkctk.exe File opened (read-only) \??\U: Tkctk.exe File opened (read-only) \??\Z: Tkctk.exe File opened (read-only) \??\B: Tkctk.exe File opened (read-only) \??\G: Tkctk.exe File opened (read-only) \??\I: Tkctk.exe File opened (read-only) \??\L: Tkctk.exe File opened (read-only) \??\H: Tkctk.exe File opened (read-only) \??\K: Tkctk.exe File opened (read-only) \??\Q: Tkctk.exe File opened (read-only) \??\S: Tkctk.exe File opened (read-only) \??\V: Tkctk.exe File opened (read-only) \??\X: Tkctk.exe File opened (read-only) \??\Y: Tkctk.exe File opened (read-only) \??\M: Tkctk.exe File opened (read-only) \??\P: Tkctk.exe File opened (read-only) \??\T: Tkctk.exe File opened (read-only) \??\W: Tkctk.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Tkctk.exe 2652af0408b5a088c9992b23774063d6185003031c00942c1e0b40a4ff1d4a07.exe File created C:\Windows\SysWOW64\Tkctk.exe 2652af0408b5a088c9992b23774063d6185003031c00942c1e0b40a4ff1d4a07.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Tkctk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Tkctk.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Tkctk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Tkctk.exe Key created \REGISTRY\USER\.DEFAULT\Software Tkctk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Tkctk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Tkctk.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2612 PING.EXE -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe 2656 Tkctk.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2244 2652af0408b5a088c9992b23774063d6185003031c00942c1e0b40a4ff1d4a07.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2640 2244 2652af0408b5a088c9992b23774063d6185003031c00942c1e0b40a4ff1d4a07.exe 29 PID 2244 wrote to memory of 2640 2244 2652af0408b5a088c9992b23774063d6185003031c00942c1e0b40a4ff1d4a07.exe 29 PID 2244 wrote to memory of 2640 2244 2652af0408b5a088c9992b23774063d6185003031c00942c1e0b40a4ff1d4a07.exe 29 PID 2244 wrote to memory of 2640 2244 2652af0408b5a088c9992b23774063d6185003031c00942c1e0b40a4ff1d4a07.exe 29 PID 2868 wrote to memory of 2656 2868 Tkctk.exe 30 PID 2868 wrote to memory of 2656 2868 Tkctk.exe 30 PID 2868 wrote to memory of 2656 2868 Tkctk.exe 30 PID 2868 wrote to memory of 2656 2868 Tkctk.exe 30 PID 2640 wrote to memory of 2612 2640 cmd.exe 32 PID 2640 wrote to memory of 2612 2640 cmd.exe 32 PID 2640 wrote to memory of 2612 2640 cmd.exe 32 PID 2640 wrote to memory of 2612 2640 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\2652af0408b5a088c9992b23774063d6185003031c00942c1e0b40a4ff1d4a07.exe"C:\Users\Admin\AppData\Local\Temp\2652af0408b5a088c9992b23774063d6185003031c00942c1e0b40a4ff1d4a07.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\2652AF~1.EXE > nul2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:2612
-
-
-
C:\Windows\SysWOW64\Tkctk.exeC:\Windows\SysWOW64\Tkctk.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\Tkctk.exeC:\Windows\SysWOW64\Tkctk.exe -acsi2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
688KB
MD5066ff45d0b248d7beba5458dfa2dbfc7
SHA18af45fd44fa59a0f70edcafe54435458aa3c5545
SHA2562652af0408b5a088c9992b23774063d6185003031c00942c1e0b40a4ff1d4a07
SHA512f9437e4b9e4b659d5c06ef70027e9b10d4a092a9a7ad9f0ed26f54c4f0caacfc83688c7d172b8c04278455e5563389013dd02c6281e3f50901ba6d81647443fc