Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
25-05-2024 13:37
General
-
Target
db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe
-
Size
1.3MB
-
MD5
e4aaaafd0ce60dd7dd3b54522a2eb1ad
-
SHA1
f9c71c06663fdb8ade290a8bf7e8f5622196946c
-
SHA256
db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72
-
SHA512
84b4c83d528b27fff384f5e20d83a81ae67bc623a65ae1e1a1e6838d4be02acacbdb725fb7bc15216cbdc7f61b469c76c871d724ed37eab0066b8f3b9c6ec5c1
-
SSDEEP
24576:q89tv9/7JtDElDEExIecl1erdg0MCiVWhR/ewpe3dk:q89XJt4HIZ/Gg0P+WhPpe3dk
Malware Config
Signatures
-
Detect PurpleFox Rootkit 14 IoCs
Detect PurpleFox Rootkit.
-
Gh0st RAT payload 14 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Drops file in Drivers directory 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Executes dropped EXE 3 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe"C:\Users\Admin\AppData\Local\Temp\db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QQ.exeC:\Users\Admin\AppData\Local\Temp\\QQ.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\QQ.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5e4aaaafd0ce60dd7dd3b54522a2eb1ad
SHA1f9c71c06663fdb8ade290a8bf7e8f5622196946c
SHA256db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72
SHA51284b4c83d528b27fff384f5e20d83a81ae67bc623a65ae1e1a1e6838d4be02acacbdb725fb7bc15216cbdc7f61b469c76c871d724ed37eab0066b8f3b9c6ec5c1
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB