Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 08:41
Static task
static1
Behavioral task
behavioral1
Sample
16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8.exe
Resource
win7-20240221-en
General
-
Target
16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8.exe
-
Size
375KB
-
MD5
bcb3fe24e81f8e6989bc8005838433a0
-
SHA1
a42a7fa621d2c3ea1aab471a4cfb2d71d505f35e
-
SHA256
16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8
-
SHA512
8deda0cdc42f9f420633feb67bf4b6a13b469d0dfdb336ec91fc3d59c4ab694cce8ae8ac61f98c3d1f59bbe676872f9663be7fbba459ec97c16eee1eae1dd298
-
SSDEEP
6144:ORjbUHOvGUNIE/FDjBazqjWgR+MSEtvlZTONpRGX5B4PY3mA0O0Gp8Nhn5Jod:ejbh9tDjiuT+xEtl0u4w3mAZyUd
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4192-2-0x0000000010000000-0x00000000101A5000-memory.dmp purplefox_rootkit behavioral2/memory/4192-4-0x0000000010000000-0x00000000101A5000-memory.dmp purplefox_rootkit behavioral2/memory/4192-3-0x0000000010000000-0x00000000101A5000-memory.dmp purplefox_rootkit behavioral2/memory/3076-16-0x0000000010000000-0x00000000101A5000-memory.dmp purplefox_rootkit behavioral2/memory/3076-15-0x0000000010000000-0x00000000101A5000-memory.dmp purplefox_rootkit behavioral2/memory/3076-18-0x0000000010000000-0x00000000101A5000-memory.dmp purplefox_rootkit behavioral2/memory/3076-21-0x0000000010000000-0x00000000101A5000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/4192-2-0x0000000010000000-0x00000000101A5000-memory.dmp family_gh0strat behavioral2/memory/4192-4-0x0000000010000000-0x00000000101A5000-memory.dmp family_gh0strat behavioral2/memory/4192-3-0x0000000010000000-0x00000000101A5000-memory.dmp family_gh0strat behavioral2/memory/3076-17-0x0000000010000000-0x00000000101A5000-memory.dmp family_gh0strat behavioral2/memory/3076-16-0x0000000010000000-0x00000000101A5000-memory.dmp family_gh0strat behavioral2/memory/3076-15-0x0000000010000000-0x00000000101A5000-memory.dmp family_gh0strat behavioral2/memory/3076-18-0x0000000010000000-0x00000000101A5000-memory.dmp family_gh0strat behavioral2/memory/3076-21-0x0000000010000000-0x00000000101A5000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
Wogwo.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys Wogwo.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
Wogwo.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Wogwo.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation 16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8.exe -
Executes dropped EXE 1 IoCs
Processes:
Wogwo.exepid process 3076 Wogwo.exe -
Processes:
resource yara_rule behavioral2/memory/4192-0-0x0000000010000000-0x00000000101A5000-memory.dmp upx behavioral2/memory/4192-2-0x0000000010000000-0x00000000101A5000-memory.dmp upx behavioral2/memory/4192-4-0x0000000010000000-0x00000000101A5000-memory.dmp upx behavioral2/memory/4192-3-0x0000000010000000-0x00000000101A5000-memory.dmp upx behavioral2/memory/3076-13-0x0000000010000000-0x00000000101A5000-memory.dmp upx behavioral2/memory/3076-17-0x0000000010000000-0x00000000101A5000-memory.dmp upx behavioral2/memory/3076-16-0x0000000010000000-0x00000000101A5000-memory.dmp upx behavioral2/memory/3076-15-0x0000000010000000-0x00000000101A5000-memory.dmp upx behavioral2/memory/3076-18-0x0000000010000000-0x00000000101A5000-memory.dmp upx behavioral2/memory/3076-21-0x0000000010000000-0x00000000101A5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
Wogwo.exepid process 3076 Wogwo.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8.exeWogwo.exedescription pid process Token: SeIncBasePriorityPrivilege 4192 16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8.exe Token: SeLoadDriverPrivilege 3076 Wogwo.exe Token: 33 3076 Wogwo.exe Token: SeIncBasePriorityPrivilege 3076 Wogwo.exe Token: 33 3076 Wogwo.exe Token: SeIncBasePriorityPrivilege 3076 Wogwo.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8.execmd.exedescription pid process target process PID 4192 wrote to memory of 3076 4192 16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8.exe Wogwo.exe PID 4192 wrote to memory of 3076 4192 16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8.exe Wogwo.exe PID 4192 wrote to memory of 3076 4192 16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8.exe Wogwo.exe PID 4192 wrote to memory of 4432 4192 16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8.exe cmd.exe PID 4192 wrote to memory of 4432 4192 16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8.exe cmd.exe PID 4192 wrote to memory of 4432 4192 16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8.exe cmd.exe PID 4432 wrote to memory of 2184 4432 cmd.exe PING.EXE PID 4432 wrote to memory of 2184 4432 cmd.exe PING.EXE PID 4432 wrote to memory of 2184 4432 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8.exe"C:\Users\Admin\AppData\Local\Temp\16e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Wogwo.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Wogwo.exe"2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:3076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\16E116~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:2184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Wogwo.exeFilesize
375KB
MD5bcb3fe24e81f8e6989bc8005838433a0
SHA1a42a7fa621d2c3ea1aab471a4cfb2d71d505f35e
SHA25616e1161c1d4af3aa8a645d1dbae0ada29fd4a7df7208b3f0656b44a7d2bbc3b8
SHA5128deda0cdc42f9f420633feb67bf4b6a13b469d0dfdb336ec91fc3d59c4ab694cce8ae8ac61f98c3d1f59bbe676872f9663be7fbba459ec97c16eee1eae1dd298
-
memory/3076-13-0x0000000010000000-0x00000000101A5000-memory.dmpFilesize
1.6MB
-
memory/3076-17-0x0000000010000000-0x00000000101A5000-memory.dmpFilesize
1.6MB
-
memory/3076-16-0x0000000010000000-0x00000000101A5000-memory.dmpFilesize
1.6MB
-
memory/3076-15-0x0000000010000000-0x00000000101A5000-memory.dmpFilesize
1.6MB
-
memory/3076-18-0x0000000010000000-0x00000000101A5000-memory.dmpFilesize
1.6MB
-
memory/3076-21-0x0000000010000000-0x00000000101A5000-memory.dmpFilesize
1.6MB
-
memory/4192-0-0x0000000010000000-0x00000000101A5000-memory.dmpFilesize
1.6MB
-
memory/4192-2-0x0000000010000000-0x00000000101A5000-memory.dmpFilesize
1.6MB
-
memory/4192-4-0x0000000010000000-0x00000000101A5000-memory.dmpFilesize
1.6MB
-
memory/4192-3-0x0000000010000000-0x00000000101A5000-memory.dmpFilesize
1.6MB