Analysis
-
max time kernel
125s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2024 11:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a35b9d5123335a57d2995ad24900396cdbbd1859215a03fa2324b980e8eca96cN.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
General
-
Target
a35b9d5123335a57d2995ad24900396cdbbd1859215a03fa2324b980e8eca96cN.exe
-
Size
2.5MB
-
MD5
a65507e62ae699fa9a942ead9a4ae9f0
-
SHA1
c4f52a0481b9b64bfce933f4343d26a9a84db33f
-
SHA256
a35b9d5123335a57d2995ad24900396cdbbd1859215a03fa2324b980e8eca96c
-
SHA512
32547172a7adb29cd3a5cf2403ad7cbbe0216eb358c1f67b4e90fcb98fbdc35b9f6a2845d9d8da018bee64b38ff64522022419b01f67fc1a6b71da93c157401d
-
SSDEEP
49152:u1vqjdPQ31PZ93aaYl1gm5TxsIGm4GZeED1jFayV4PxDZmc7iNEG:u1vqjY1PrqaYlvNFGvApD1jFZV4xZm+W
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2440-8-0x0000000010000000-0x0000000010199000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2440-8-0x0000000010000000-0x0000000010199000-memory.dmp family_gh0strat -
Executes dropped EXE 1 IoCs
pid Process 2440 xqxin.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: xqxin.exe File opened (read-only) \??\Y: xqxin.exe File opened (read-only) \??\I: xqxin.exe File opened (read-only) \??\J: xqxin.exe File opened (read-only) \??\K: xqxin.exe File opened (read-only) \??\M: xqxin.exe File opened (read-only) \??\R: xqxin.exe File opened (read-only) \??\E: xqxin.exe File opened (read-only) \??\H: xqxin.exe File opened (read-only) \??\N: xqxin.exe File opened (read-only) \??\P: xqxin.exe File opened (read-only) \??\U: xqxin.exe File opened (read-only) \??\G: xqxin.exe File opened (read-only) \??\L: xqxin.exe File opened (read-only) \??\V: xqxin.exe File opened (read-only) \??\X: xqxin.exe File opened (read-only) \??\Z: xqxin.exe File opened (read-only) \??\B: xqxin.exe File opened (read-only) \??\O: xqxin.exe File opened (read-only) \??\Q: xqxin.exe File opened (read-only) \??\S: xqxin.exe File opened (read-only) \??\T: xqxin.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\xinxq\xqxin.exe a35b9d5123335a57d2995ad24900396cdbbd1859215a03fa2324b980e8eca96cN.exe File opened for modification C:\Windows\SysWOW64\xinxq\xqxin.exe a35b9d5123335a57d2995ad24900396cdbbd1859215a03fa2324b980e8eca96cN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a35b9d5123335a57d2995ad24900396cdbbd1859215a03fa2324b980e8eca96cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xqxin.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 xqxin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz xqxin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2472 a35b9d5123335a57d2995ad24900396cdbbd1859215a03fa2324b980e8eca96cN.exe 2472 a35b9d5123335a57d2995ad24900396cdbbd1859215a03fa2324b980e8eca96cN.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe 2440 xqxin.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2440 xqxin.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2440 2472 a35b9d5123335a57d2995ad24900396cdbbd1859215a03fa2324b980e8eca96cN.exe 89 PID 2472 wrote to memory of 2440 2472 a35b9d5123335a57d2995ad24900396cdbbd1859215a03fa2324b980e8eca96cN.exe 89 PID 2472 wrote to memory of 2440 2472 a35b9d5123335a57d2995ad24900396cdbbd1859215a03fa2324b980e8eca96cN.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\a35b9d5123335a57d2995ad24900396cdbbd1859215a03fa2324b980e8eca96cN.exe"C:\Users\Admin\AppData\Local\Temp\a35b9d5123335a57d2995ad24900396cdbbd1859215a03fa2324b980e8eca96cN.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\xinxq\xqxin.exe"C:\Windows\SysWOW64\xinxq\xqxin.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4092,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:81⤵PID:1116
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD570006fffc23d4d0da84d7718d5047397
SHA163024d1f3ce63c38d4d02bf5060d308b028a0913
SHA25674d9d7e91ea5d958e50380f0e672e8638302de7fa13aa2c5c4f1625c27bc7ea2
SHA512d7fd4ea5b57f8d05507c812075b899b95b7664c0f09adca6c7534ce74c0696b1aab74deabaf7b5ff40e00ef51b427c17c38593e1d6fce21160ce8ac7145befa9