Analysis
-
max time kernel
146s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
07-11-2024 06:09
Static task
static1
Behavioral task
behavioral1
Sample
3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exe
Resource
win7-20241023-en
General
-
Target
3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exe
-
Size
1.3MB
-
MD5
9204d1a9f144fcb090c9c90dc47f84a3
-
SHA1
07d6204567cdf545123ae2eccf2012f65b477422
-
SHA256
3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc
-
SHA512
4dfe9d36dfd2767b0b0b88a8522f57d2137e5cffbc99609c1219224fd3433755caf00b918a5fd64a02ae572c17f099898be6fc5adc747e85e412e3bc935e719f
-
SSDEEP
24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNJ:QHPkVOBTK
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2076-0-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2076-0-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Drops file in Drivers directory 1 IoCs
Processes:
ÓãÃÅ.kxdescription ioc Process File created C:\Windows\system32\drivers\QAssist.sys ÓãÃÅ.kx -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
ÓãÃÅ.kxdescription ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" ÓãÃÅ.kx -
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 1656 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
ÓãÃÅ.kxÓãÃÅ.kxpid Process 2432 ÓãÃÅ.kx 2584 ÓãÃÅ.kx -
Loads dropped DLL 1 IoCs
Processes:
ÓãÃÅ.kxpid Process 2432 ÓãÃÅ.kx -
Drops file in System32 directory 2 IoCs
Processes:
3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exedescription ioc Process File created C:\Windows\SysWOW64\ÓãÃÅ.kx 3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exe File opened for modification C:\Windows\SysWOW64\ÓãÃÅ.kx 3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exeÓãÃÅ.kxÓãÃÅ.kxcmd.exePING.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ÓãÃÅ.kx Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ÓãÃÅ.kx Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.exePING.EXEpid Process 1656 cmd.exe 2968 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
ÓãÃÅ.kxpid Process 2584 ÓãÃÅ.kx -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exeÓãÃÅ.kxdescription pid Process Token: SeIncBasePriorityPrivilege 2076 3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exe Token: SeLoadDriverPrivilege 2584 ÓãÃÅ.kx Token: 33 2584 ÓãÃÅ.kx Token: SeIncBasePriorityPrivilege 2584 ÓãÃÅ.kx Token: 33 2584 ÓãÃÅ.kx Token: SeIncBasePriorityPrivilege 2584 ÓãÃÅ.kx -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exeÓãÃÅ.kxcmd.exedescription pid Process procid_target PID 2076 wrote to memory of 1656 2076 3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exe 32 PID 2076 wrote to memory of 1656 2076 3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exe 32 PID 2076 wrote to memory of 1656 2076 3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exe 32 PID 2076 wrote to memory of 1656 2076 3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exe 32 PID 2432 wrote to memory of 2584 2432 ÓãÃÅ.kx 33 PID 2432 wrote to memory of 2584 2432 ÓãÃÅ.kx 33 PID 2432 wrote to memory of 2584 2432 ÓãÃÅ.kx 33 PID 2432 wrote to memory of 2584 2432 ÓãÃÅ.kx 33 PID 1656 wrote to memory of 2968 1656 cmd.exe 35 PID 1656 wrote to memory of 2968 1656 cmd.exe 35 PID 1656 wrote to memory of 2968 1656 cmd.exe 35 PID 1656 wrote to memory of 2968 1656 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exe"C:\Users\Admin\AppData\Local\Temp\3793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\3793F8~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2968
-
-
-
C:\Windows\SysWOW64\ÓãÃÅ.kxC:\Windows\SysWOW64\ÓãÃÅ.kx -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\ÓãÃÅ.kxC:\Windows\SysWOW64\ÓãÃÅ.kx -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD59204d1a9f144fcb090c9c90dc47f84a3
SHA107d6204567cdf545123ae2eccf2012f65b477422
SHA2563793f852766cc51db8469910c5f6c72ba68cd83ccd4423def8ee87148a0918bc
SHA5124dfe9d36dfd2767b0b0b88a8522f57d2137e5cffbc99609c1219224fd3433755caf00b918a5fd64a02ae572c17f099898be6fc5adc747e85e412e3bc935e719f