Analysis
-
max time kernel
93s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2024 22:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
421814bcfd6151ca77a57216c6eaac30N.exe
Resource
win7-20240708-en
windows7-x64
14 signatures
120 seconds
General
-
Target
421814bcfd6151ca77a57216c6eaac30N.exe
-
Size
2.7MB
-
MD5
421814bcfd6151ca77a57216c6eaac30
-
SHA1
97c6c0e158cb2df96560a06a0ea506ffb3ee4aeb
-
SHA256
49c7948122ca841cae152b7b09d0f152fb4c4d35318562c877bea1743fb23dc1
-
SHA512
b341e7b965f565754ccc9a22da5a5bab47fdd8b4c6f5821ebea38acf2331a364a5d438ea3fc69fd710c859437439166f5a58631512017510c1e9a5bfc8b8bd17
-
SSDEEP
49152:O1vqjdPQiK2ClsFXbuOpGJ7nJmUFQ3oW9ry0uwgR7p/kGOI+gtm:O1vqjjXkJ7nQY4ry0utR7psGOI+am
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3924-8-0x0000000010000000-0x0000000010199000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/3924-8-0x0000000010000000-0x0000000010199000-memory.dmp family_gh0strat -
Executes dropped EXE 1 IoCs
pid Process 3924 xiaoqip.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: xiaoqip.exe File opened (read-only) \??\K: xiaoqip.exe File opened (read-only) \??\N: xiaoqip.exe File opened (read-only) \??\R: xiaoqip.exe File opened (read-only) \??\Z: xiaoqip.exe File opened (read-only) \??\E: xiaoqip.exe File opened (read-only) \??\H: xiaoqip.exe File opened (read-only) \??\O: xiaoqip.exe File opened (read-only) \??\Q: xiaoqip.exe File opened (read-only) \??\U: xiaoqip.exe File opened (read-only) \??\L: xiaoqip.exe File opened (read-only) \??\M: xiaoqip.exe File opened (read-only) \??\P: xiaoqip.exe File opened (read-only) \??\V: xiaoqip.exe File opened (read-only) \??\B: xiaoqip.exe File opened (read-only) \??\I: xiaoqip.exe File opened (read-only) \??\J: xiaoqip.exe File opened (read-only) \??\S: xiaoqip.exe File opened (read-only) \??\T: xiaoqip.exe File opened (read-only) \??\W: xiaoqip.exe File opened (read-only) \??\X: xiaoqip.exe File opened (read-only) \??\Y: xiaoqip.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\xq\xiaoqip.exe 421814bcfd6151ca77a57216c6eaac30N.exe File opened for modification C:\Windows\SysWOW64\xq\xiaoqip.exe 421814bcfd6151ca77a57216c6eaac30N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 421814bcfd6151ca77a57216c6eaac30N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xiaoqip.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 xiaoqip.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz xiaoqip.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 228 421814bcfd6151ca77a57216c6eaac30N.exe 228 421814bcfd6151ca77a57216c6eaac30N.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3924 xiaoqip.exe 3924 xiaoqip.exe 3924 xiaoqip.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 228 wrote to memory of 3924 228 421814bcfd6151ca77a57216c6eaac30N.exe 84 PID 228 wrote to memory of 3924 228 421814bcfd6151ca77a57216c6eaac30N.exe 84 PID 228 wrote to memory of 3924 228 421814bcfd6151ca77a57216c6eaac30N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\421814bcfd6151ca77a57216c6eaac30N.exe"C:\Users\Admin\AppData\Local\Temp\421814bcfd6151ca77a57216c6eaac30N.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\xq\xiaoqip.exe"C:\Windows\SysWOW64\xq\xiaoqip.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5934e7f6716c9e8375f2b812a67c9e284
SHA192c85477f6c3851ae7082bea74a40b736c16e80e
SHA25669349e7b18174481ce27245c7f0487ce8afed1d95b58a9975aa896edec35db57
SHA5124be3454c538f7704845b3f196f97e95243642bdda95ede4c1e6b5f72d74a86098307a9ff205d6548658e14b107e2a003aebd4e84b400bb490d613a3a16a8d4d0