Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-09-2024 16:25
General
-
Target
b466d99f7757d9d97911f11f8ae9e5e24ce8d2c528a83b65fb124670b4bfa9ac.exe
-
Size
12.2MB
-
MD5
425e7fbb7ebb52d5cee5275456b80f0c
-
SHA1
5fcdbb98e2ef9e12ca3850b600e0a93f734347a2
-
SHA256
b466d99f7757d9d97911f11f8ae9e5e24ce8d2c528a83b65fb124670b4bfa9ac
-
SHA512
7ac0fca230e5cf7d119b175f91d4ba53702e55548a714ed71bf13b41b62ecb9d90ab8d19878dfe7019475791582b0e20f9c3aabe9e8538b593a6ed5811121934
-
SSDEEP
393216:i7lSEKH3HVklBf1kjsXHmMFrJEr5jcEve2/FleI:SlNwVsBbHz8r5j9vRle
Malware Config
Signatures
-
Detect PurpleFox Rootkit 11 IoCs
Detect PurpleFox Rootkit.
-
Gh0st RAT payload 11 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Drops file in Drivers directory 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Executes dropped EXE 4 IoCs
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b466d99f7757d9d97911f11f8ae9e5e24ce8d2c528a83b65fb124670b4bfa9ac.exe"C:\Users\Admin\AppData\Local\Temp\b466d99f7757d9d97911f11f8ae9e5e24ce8d2c528a83b65fb124670b4bfa9ac.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QQ.exeC:\Users\Admin\AppData\Local\Temp\\QQ.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\QQ.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_b466d99f7757d9d97911f11f8ae9e5e24ce8d2c528a83b65fb124670b4bfa9ac.exeC:\Users\Admin\AppData\Local\Temp\HD_b466d99f7757d9d97911f11f8ae9e5e24ce8d2c528a83b65fb124670b4bfa9ac.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.8MB
MD570d1abf37bdaa1de52d3985603529ab1
SHA14def68e9d8ec94421f2e07575af5dc3184635723
SHA25671aa84bc19f44a81c149caec4c2fbb925c219d29a12aa57e96e99db6f6e361f7
SHA512a9623e8f1e0113ab1f05763b7e0382f023c15803b141036ff9032bcab51e7adc2be2183a6cdb3693c941b5cd72196eaeb8daabaf27d3b2c87eedb8d4110df5af
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
2.4MB
MD57648e66a82cc20cadd60891b0d15937b
SHA178d422ffb004e84eabb77e9678c849120b4b3a91
SHA2563571efed8c053e177da72d8f891ff39a64a258a8dbce681857de3edaac9464b1
SHA51250363ee1df2ba01484e5b83123754da9633d7ee8f87c3b9cea81d1283c7b81608acc2506ac5bb416b2e309f86ee31b01260ee7860ad8e725c771cda608f7919d
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
17.2MB
-
Filesize
1.8MB
-
Filesize
17.2MB