Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
26-05-2024 10:48
General
-
Target
ef1142488f830d8f22cd93566f1594e0a3a7c91b999c03e8b5aafbc384f17178.exe
-
Size
12.4MB
-
MD5
8a78fccb8f53a8a67334aa26e2be22d1
-
SHA1
cb93eb5ff96b4070f75201e9298a9c76789c44c4
-
SHA256
ef1142488f830d8f22cd93566f1594e0a3a7c91b999c03e8b5aafbc384f17178
-
SHA512
b4443ef7233746ed863525b4c059f775b8f8606b195cfe74cdd6b35b8b13f14de0158b3453fc3779473c918dbdf11981495f375d80da64e0a033bd970a58e9d8
-
SSDEEP
196608:rKXbeO7zebPBbqVm9ZCepw7A3TyYGtuOkLcN4bn+rIkNv7y0tvWSAtcESnAeg:g7zOBbaIZCep3TViND5R7B9AaAeg
Malware Config
Signatures
-
Detect PurpleFox Rootkit 8 IoCs
Detect PurpleFox Rootkit.
-
Gh0st RAT payload 9 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Drops file in Drivers directory 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Executes dropped EXE 9 IoCs
-
Loads dropped DLL 3 IoCs
-
UPX packed file 32 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef1142488f830d8f22cd93566f1594e0a3a7c91b999c03e8b5aafbc384f17178.exe"C:\Users\Admin\AppData\Local\Temp\ef1142488f830d8f22cd93566f1594e0a3a7c91b999c03e8b5aafbc384f17178.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\HD_ef1142488f830d8f22cd93566f1594e0a3a7c91b999c03e8b5aafbc384f17178.exeC:\Users\Admin\AppData\Local\Temp\HD_ef1142488f830d8f22cd93566f1594e0a3a7c91b999c03e8b5aafbc384f17178.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240601218.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\HD_ef1142488f830d8f22cd93566f1594e0a3a7c91b999c03e8b5aafbc384f17178.exe"C:\Users\Admin\AppData\Local\Temp\HD_ef1142488f830d8f22cd93566f1594e0a3a7c91b999c03e8b5aafbc384f17178.exe" --runservice1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HD_ef1142488f830d8f22cd93566f1594e0a3a7c91b999c03e8b5aafbc384f17178.exe"C:\Users\Admin\AppData\Local\Temp\HD_ef1142488f830d8f22cd93566f1594e0a3a7c91b999c03e8b5aafbc384f17178.exe" --hide --localPort=356002⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\HD_ef1142488f830d8f22cd93566f1594e0a3a7c91b999c03e8b5aafbc384f17178.exe"C:\Users\Admin\AppData\Local\Temp\HD_ef1142488f830d8f22cd93566f1594e0a3a7c91b999c03e8b5aafbc384f17178.exe" --show --localPort=356002⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98B
MD5d5781f0f878e44179281c2f6a3c13b21
SHA10fdf7e14aa6edeab474057d13271b9c83c49bbd3
SHA256bf4b1ba8952992af76f76ae3b00494da69046c0fca7ef1e77f97c6b7adefa5c3
SHA5126975b6c982f0940f58b1e5d36bdca5ee9c374f64487589f78baf56f1d9799ecc2b8e37de91cc1a8b794f9357b484ca5b5879acd5abba27bc8b481fcc39950e59
-
Filesize
414B
MD5499339fb5c635f970c6fe2e7e3690f59
SHA1f438cc627829743b42c63ffd1efb4de268146574
SHA256fe89e7fb9cfe754349a21d34d8645eb191d934c3638ef6dc6593e0284c3aaf20
SHA51262d0a18f6e964b5406222d0ded2d4c9210a9e80af2cf85c9b4e57c4985e8b0c47ece5301a2c001f9a88e66b51732c89f6c4143fbd7157740df118d0778f6b367
-
Filesize
2.3MB
MD5876f8fe28aa8f499ef27a9b4aed89b63
SHA105491cfd311e2f7fdad78efc9c5e19153164b4c2
SHA256b543c3b63c7457933659682bbe57e6d3e76db23cb102904789573be72fd6f402
SHA512ee30326e6500c004c47bae41715b3c96362cf2af95febc032f0c1efef4c0cc0ec1eaa0a4b3f1da1e0a93f482161cce8ca45095848c296dba8ab8198e9ddcb965
-
Filesize
10.1MB
MD5ef7e02e09444ac450db4e6e819e9fa29
SHA1ca0606290aeacfcd238f354b88c4fc7ef2a5a958
SHA2566a6beec11b7eb538a47f9784d7ce715cacb92def465cd4824431212325865986
SHA512154a3944f53d98e012590d6a0a8d0c87f1fc9c58debe66ce93c152a6b6c5164e6fac630cad9803e7c7c6b75deb2a7aded870fefee144229da81be19d87b5dd74
-
Filesize
377KB
MD54a36a48e58829c22381572b2040b6fe0
SHA1f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA2563de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA5125d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
-
Filesize
941KB
MD58dc3adf1c490211971c1e2325f1424d2
SHA14eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
-
Filesize
899KB
MD588c9ea6649dd81f278d2646ae5aa2c87
SHA14408c340c03ab2c82b3729c9ad6fb08fbeb14b89
SHA2563de0b8afe4d723fa5c496b8090e75bb9d4b6c869e8ec9e35a51ba29be005f18b
SHA5127b746a6c0ea9e954e6db69b870f08ddb2e2270030d6e95e522a2d44d8a1ff04c37ebe2fc76abae1ffe8e9fd5bb1d0041acc866a024b148c05d78124af32f73cf
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
27.9MB
-
Filesize
27.9MB