Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 23:55
Static task
static1
Behavioral task
behavioral1
Sample
5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe
Resource
win7-20240221-en
General
-
Target
5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe
-
Size
1.3MB
-
MD5
a1d12b0b8ba965e40b8ef58b9c7d78f9
-
SHA1
0eeb0a279abad5de4f24131c410c0e05ec10a665
-
SHA256
5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05
-
SHA512
b65d3d977b736a2c8a70059c5f7dc8e686091223a5277c2506bedd192a3ea57bac038d2aacf7f0669428f77db909b1d5c0f154a37c4bdcdc456077e3a9a3ce94
-
SSDEEP
24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNw:QHPkVOBTK
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2648-0-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral1/memory/2492-17-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2648-0-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral1/memory/2492-17-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
Vnfvn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys Vnfvn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
Vnfvn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Vnfvn.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2912 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
Vnfvn.exeVnfvn.exepid process 3004 Vnfvn.exe 2492 Vnfvn.exe -
Drops file in System32 directory 2 IoCs
Processes:
5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exedescription ioc process File created C:\Windows\SysWOW64\Vnfvn.exe 5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe File opened for modification C:\Windows\SysWOW64\Vnfvn.exe 5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
Vnfvn.exepid process 2492 Vnfvn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exeVnfvn.exedescription pid process Token: SeIncBasePriorityPrivilege 2648 5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe Token: SeLoadDriverPrivilege 2492 Vnfvn.exe Token: 33 2492 Vnfvn.exe Token: SeIncBasePriorityPrivilege 2492 Vnfvn.exe Token: 33 2492 Vnfvn.exe Token: SeIncBasePriorityPrivilege 2492 Vnfvn.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exeVnfvn.execmd.exedescription pid process target process PID 2648 wrote to memory of 2912 2648 5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe cmd.exe PID 2648 wrote to memory of 2912 2648 5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe cmd.exe PID 2648 wrote to memory of 2912 2648 5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe cmd.exe PID 2648 wrote to memory of 2912 2648 5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe cmd.exe PID 3004 wrote to memory of 2492 3004 Vnfvn.exe Vnfvn.exe PID 3004 wrote to memory of 2492 3004 Vnfvn.exe Vnfvn.exe PID 3004 wrote to memory of 2492 3004 Vnfvn.exe Vnfvn.exe PID 3004 wrote to memory of 2492 3004 Vnfvn.exe Vnfvn.exe PID 2912 wrote to memory of 2716 2912 cmd.exe PING.EXE PID 2912 wrote to memory of 2716 2912 cmd.exe PING.EXE PID 2912 wrote to memory of 2716 2912 cmd.exe PING.EXE PID 2912 wrote to memory of 2716 2912 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe"C:\Users\Admin\AppData\Local\Temp\5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\5D92AC~1.EXE > nul2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\Vnfvn.exeC:\Windows\SysWOW64\Vnfvn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Vnfvn.exeC:\Windows\SysWOW64\Vnfvn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Vnfvn.exeFilesize
1.3MB
MD5a1d12b0b8ba965e40b8ef58b9c7d78f9
SHA10eeb0a279abad5de4f24131c410c0e05ec10a665
SHA2565d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05
SHA512b65d3d977b736a2c8a70059c5f7dc8e686091223a5277c2506bedd192a3ea57bac038d2aacf7f0669428f77db909b1d5c0f154a37c4bdcdc456077e3a9a3ce94
-
memory/2492-17-0x0000000010000000-0x000000001019F000-memory.dmpFilesize
1.6MB
-
memory/2648-0-0x0000000010000000-0x000000001019F000-memory.dmpFilesize
1.6MB