Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 23:55
Static task
static1
Behavioral task
behavioral1
Sample
5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe
Resource
win7-20240221-en
General
-
Target
5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe
-
Size
1.3MB
-
MD5
a1d12b0b8ba965e40b8ef58b9c7d78f9
-
SHA1
0eeb0a279abad5de4f24131c410c0e05ec10a665
-
SHA256
5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05
-
SHA512
b65d3d977b736a2c8a70059c5f7dc8e686091223a5277c2506bedd192a3ea57bac038d2aacf7f0669428f77db909b1d5c0f154a37c4bdcdc456077e3a9a3ce94
-
SSDEEP
24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNw:QHPkVOBTK
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/912-0-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral2/memory/4392-10-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/912-0-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral2/memory/4392-10-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
Vnfvn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys Vnfvn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
Vnfvn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Vnfvn.exe -
Executes dropped EXE 2 IoCs
Processes:
Vnfvn.exeVnfvn.exepid process 4392 Vnfvn.exe 1036 Vnfvn.exe -
Drops file in System32 directory 2 IoCs
Processes:
5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exedescription ioc process File created C:\Windows\SysWOW64\Vnfvn.exe 5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe File opened for modification C:\Windows\SysWOW64\Vnfvn.exe 5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
Vnfvn.exepid process 1036 Vnfvn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exeVnfvn.exedescription pid process Token: SeIncBasePriorityPrivilege 912 5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe Token: SeLoadDriverPrivilege 1036 Vnfvn.exe Token: 33 1036 Vnfvn.exe Token: SeIncBasePriorityPrivilege 1036 Vnfvn.exe Token: 33 1036 Vnfvn.exe Token: SeIncBasePriorityPrivilege 1036 Vnfvn.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exeVnfvn.execmd.exedescription pid process target process PID 912 wrote to memory of 1164 912 5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe cmd.exe PID 912 wrote to memory of 1164 912 5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe cmd.exe PID 912 wrote to memory of 1164 912 5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe cmd.exe PID 4392 wrote to memory of 1036 4392 Vnfvn.exe Vnfvn.exe PID 4392 wrote to memory of 1036 4392 Vnfvn.exe Vnfvn.exe PID 4392 wrote to memory of 1036 4392 Vnfvn.exe Vnfvn.exe PID 1164 wrote to memory of 1312 1164 cmd.exe PING.EXE PID 1164 wrote to memory of 1312 1164 cmd.exe PING.EXE PID 1164 wrote to memory of 1312 1164 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe"C:\Users\Admin\AppData\Local\Temp\5d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\5D92AC~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\Vnfvn.exeC:\Windows\SysWOW64\Vnfvn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Vnfvn.exeC:\Windows\SysWOW64\Vnfvn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Vnfvn.exeFilesize
1.3MB
MD5a1d12b0b8ba965e40b8ef58b9c7d78f9
SHA10eeb0a279abad5de4f24131c410c0e05ec10a665
SHA2565d92ac05afb5f066ef189377c8d207d72b1406be29696fd4307d67c71dc1fb05
SHA512b65d3d977b736a2c8a70059c5f7dc8e686091223a5277c2506bedd192a3ea57bac038d2aacf7f0669428f77db909b1d5c0f154a37c4bdcdc456077e3a9a3ce94
-
memory/912-0-0x0000000010000000-0x000000001019F000-memory.dmpFilesize
1.6MB
-
memory/4392-10-0x0000000010000000-0x000000001019F000-memory.dmpFilesize
1.6MB