Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
26-05-2024 07:52
General
-
Target
779ce9c48724f21764129a8b384005f56f4d8b1c882708dd2ed3b15c74f72da6.exe
-
Size
6.4MB
-
MD5
3336f48821062d073a9b2f006e368d06
-
SHA1
bf8e0acf47b5dadb22c620369f72d1ae7f4b6f6b
-
SHA256
779ce9c48724f21764129a8b384005f56f4d8b1c882708dd2ed3b15c74f72da6
-
SHA512
742923052cf2bec726c64eae0b9447d4503165910ff7a65bff27a1e558b945ae55bfa84f244888f30e0f357df1f6eec088eda9bd3dd7fc02a448ace993c21eaf
-
SSDEEP
98304:Fws2ANnKXOaeOgmhE4sqgwk9rrHkMt0+RYcParunz09Ur1B:vKXbeO7K4TgjkMtPR3ai1
Malware Config
Signatures
-
Detect PurpleFox Rootkit 8 IoCs
Detect PurpleFox Rootkit.
-
Gh0st RAT payload 9 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Drops file in Drivers directory 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 3 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 6 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\779ce9c48724f21764129a8b384005f56f4d8b1c882708dd2ed3b15c74f72da6.exe"C:\Users\Admin\AppData\Local\Temp\779ce9c48724f21764129a8b384005f56f4d8b1c882708dd2ed3b15c74f72da6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\HD_779ce9c48724f21764129a8b384005f56f4d8b1c882708dd2ed3b15c74f72da6.exeC:\Users\Admin\AppData\Local\Temp\HD_779ce9c48724f21764129a8b384005f56f4d8b1c882708dd2ed3b15c74f72da6.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240595906.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD52060a2cc388a7b1ba55ec7ca32637be9
SHA1df7513ed739eeaeda967bfacfd9ac1e2cdbd18fa
SHA25682860c56c7502467bb420c7ec886ca08862adf42cb8baf99fdb4f8088077e233
SHA5125d0fdf1aa5d12c42df6fd416a8f53571217d1bddc4f5d356d03dcf7d17d0b12ba063965e15845bcf5bcce30266d8733cecb023541b430e4803ba05343049b689
-
Filesize
2.3MB
MD5372f8ffc3aedd40cd5ad1d660e6c27ce
SHA113eef8199a9b5dada724a7a8af3cee324ae3d106
SHA25692c8447ade8d3728ec38c199279365e8a28407bf25e1edc1ea85377b6e3769af
SHA5126e5728afa7ce85f576b722f0c375e73d08eeadfcdea30db1f75956da45dee30bb7713f832aa8fa4d95458c25d68c883cb8280c27ff03a505dfe1bc9e44fad7da
-
Filesize
377KB
MD54a36a48e58829c22381572b2040b6fe0
SHA1f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA2563de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA5125d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
-
Filesize
941KB
MD58dc3adf1c490211971c1e2325f1424d2
SHA14eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
-
Filesize
899KB
MD580a3bc73cc6175d56fdd0d4e4836c3d5
SHA11e5d76aa94619cde662f3b27ce1b8b3c5d4bc58d
SHA2563a7e37d8efb33c431362e7ada3a0d6fcaa6a7f78501878a063b8d24e57fcba8e
SHA5124eea6ff8e88e5cd242efb56a6b4f065d1ffcfc51ffc159716ec6a3540dbd0f256e1e39fb430b77d783d26823a57e76bd930afbfb29e372e0fb81fc976ae24d45
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
10.4MB
-
Filesize
10.4MB
-
Filesize
10.4MB
-
Filesize
10.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.4MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB