Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-11-2024 01:19
Behavioral task
behavioral1
Sample
ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe
Resource
win7-20240903-en
General
-
Target
ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe
-
Size
1.2MB
-
MD5
4c0c9b2f2f81b20e7c9fa291c01c893f
-
SHA1
c2b5f51592389286b164b923242a20829a92852e
-
SHA256
ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4
-
SHA512
5bbed2affaaedfe8fad4cf5623aa50eace7dce4b062309eaf1e9ede07b5fcedfac38c0a995046750f9ec03a6f2d230802d94537e7af5490f8de53bbf9805fa68
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtix:WIwgMEuy+inDfp3/XoCw57XYBwKx
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2444-24-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/2444-23-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/2720-49-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/2720-53-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/2720-65-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 6 IoCs
resource yara_rule behavioral1/files/0x0008000000016d36-15.dat family_gh0strat behavioral1/memory/2444-24-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/2444-23-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/2720-49-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/2720-53-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/2720-65-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys Ghiya.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259451003.txt" AK47.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Ghiya.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.lnk ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe -
Executes dropped EXE 6 IoCs
pid Process 2064 AK47.exe 316 AK47.exe 2444 AK74.exe 2828 Ghiya.exe 2720 Ghiya.exe 2780 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 10 IoCs
pid Process 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 2064 AK47.exe 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 2672 svchost.exe 2828 Ghiya.exe 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 2672 svchost.exe 2780 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
resource yara_rule behavioral1/memory/2432-0-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/2432-1-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/files/0x0009000000016c95-60.dat vmprotect behavioral1/memory/2432-74-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/2432-80-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/2432-83-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/2432-87-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/2432-90-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/2432-93-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/2432-96-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\360safo = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchcst.exe" ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\259451003.txt AK47.exe File created C:\Windows\SysWOW64\Ghiya.exe AK74.exe File opened for modification C:\Windows\SysWOW64\Ghiya.exe AK74.exe File opened for modification C:\Windows\SysWOW64\ini.ini AK47.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\259451003.txt AK47.exe -
resource yara_rule behavioral1/memory/2444-24-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2444-23-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2444-21-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2720-49-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2720-53-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2720-65-0x0000000010000000-0x00000000101BA000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AK74.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghiya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AK47.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AK47.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2832 cmd.exe 2020 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2020 PING.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2720 Ghiya.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2444 AK74.exe Token: SeLoadDriverPrivilege 2720 Ghiya.exe Token: 33 2720 Ghiya.exe Token: SeIncBasePriorityPrivilege 2720 Ghiya.exe Token: 33 2720 Ghiya.exe Token: SeIncBasePriorityPrivilege 2720 Ghiya.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2064 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 31 PID 2432 wrote to memory of 2064 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 31 PID 2432 wrote to memory of 2064 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 31 PID 2432 wrote to memory of 2064 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 31 PID 2432 wrote to memory of 316 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 32 PID 2432 wrote to memory of 316 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 32 PID 2432 wrote to memory of 316 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 32 PID 2432 wrote to memory of 316 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 32 PID 2432 wrote to memory of 2444 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 33 PID 2432 wrote to memory of 2444 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 33 PID 2432 wrote to memory of 2444 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 33 PID 2432 wrote to memory of 2444 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 33 PID 2432 wrote to memory of 2444 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 33 PID 2432 wrote to memory of 2444 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 33 PID 2432 wrote to memory of 2444 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 33 PID 2444 wrote to memory of 2832 2444 AK74.exe 37 PID 2444 wrote to memory of 2832 2444 AK74.exe 37 PID 2444 wrote to memory of 2832 2444 AK74.exe 37 PID 2444 wrote to memory of 2832 2444 AK74.exe 37 PID 2828 wrote to memory of 2720 2828 Ghiya.exe 39 PID 2828 wrote to memory of 2720 2828 Ghiya.exe 39 PID 2828 wrote to memory of 2720 2828 Ghiya.exe 39 PID 2828 wrote to memory of 2720 2828 Ghiya.exe 39 PID 2828 wrote to memory of 2720 2828 Ghiya.exe 39 PID 2828 wrote to memory of 2720 2828 Ghiya.exe 39 PID 2828 wrote to memory of 2720 2828 Ghiya.exe 39 PID 2432 wrote to memory of 2604 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 40 PID 2432 wrote to memory of 2604 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 40 PID 2432 wrote to memory of 2604 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 40 PID 2432 wrote to memory of 2604 2432 ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe 40 PID 2832 wrote to memory of 2020 2832 cmd.exe 41 PID 2832 wrote to memory of 2020 2832 cmd.exe 41 PID 2832 wrote to memory of 2020 2832 cmd.exe 41 PID 2832 wrote to memory of 2020 2832 cmd.exe 41 PID 2672 wrote to memory of 2780 2672 svchost.exe 43 PID 2672 wrote to memory of 2780 2672 svchost.exe 43 PID 2672 wrote to memory of 2780 2672 svchost.exe 43 PID 2672 wrote to memory of 2780 2672 svchost.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe"C:\Users\Admin\AppData\Local\Temp\ed0221a7bcf8a2bab7469d903f6dde8ed69e07c04a7a0f1c1f2617953aee71a4.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\AK47.exe"C:\Users\Admin\AppData\Local\Temp\AK47.exe"2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2064
-
-
C:\Users\Admin\AppData\Local\Temp\AK47.exeC:\Users\Admin\AppData\Local\Temp\\AK47.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:316
-
-
C:\Users\Admin\AppData\Local\Temp\AK74.exeC:\Users\Admin\AppData\Local\Temp\\AK74.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\AK74.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2020
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
PID:2604
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵PID:2636
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259451003.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2780
-
-
C:\Windows\SysWOW64\Ghiya.exeC:\Windows\SysWOW64\Ghiya.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\Ghiya.exeC:\Windows\SysWOW64\Ghiya.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD529ce53e2a4a446614ccc8d64d346bde4
SHA139a7aa5cc1124842aa0c25abb16ea94452125cbe
SHA25656225be6838bc6e93ea215891eacf28844ae27a9f8b2b29bf19d3a8c2b1f58df
SHA512b2c5a2708c427171a5715801f8ea733ffe88d73aaaaf59c5c752ea32cbe7aae8526cc26eabe84ad5043174c0c69b1d6b15a9fb125c15accfac3462d5d08a0faa
-
Filesize
753B
MD5e4340793e446bb992c30bd54dd9a66e8
SHA1d8836b459b162dd35fce0229634a24ab65f88d98
SHA25634bde41da2daed5b5cf715815f3d9763f4d83f06e2547584c2a3f83f093d8af8
SHA512c101b97c374a82501d9131e5e71509a766f191e126c0856c4a012d840e1608ae721bf21151f6fffe0ac18f7fc5e22336541b7b5fa7473c8c57f64ee3e7c046f7
-
Filesize
91KB
MD5423eb994ed553294f8a6813619b8da87
SHA1eca6a16ccd13adcfc27bc1041ddef97ec8081255
SHA256050b4f2d5ae8eaecd414318dc8e222a56f169626da6ca8feb7edd78e8b1f0218
SHA512fab0a9af8031c242c486de373df7277c8b0e39f7a0c9c2ac2e385dbd3ea67be16e91b128287634f76131e5264149ab1b452cd21df4c4895e8c4efc8d8cf99095
-
Filesize
400KB
MD5b0998aa7d5071d33daa5b60b9c3c9735
SHA19365a1ff0c6de244d6f36c8d84072cc916665d3c
SHA2563080b6bb456564899b0d99d4131bd6a0b284d31f7d80ef773e4872d94048d49a
SHA512308c13cda9fea39b980ae686f44afd9090e9cb8970fffc4436320e0d09a31aee5e656914e0121fe888098a14c52749716fa04980396fd6ac70a88c11cbb6b850
-
Filesize
1.2MB
MD517146ca7e5c005953dad2997a6e795ff
SHA1febb240dfeb6be8d973f069e6e5f10657151b004
SHA2565d14257e2634dba4e3def5ef930386935b6d46cbe62e03b6c67b9ea4adcc87db
SHA5125b42d3f1b3e1c0a75331865760537509a22c3dcc195473ced57118cf19c53c16e976f0c17533d15ad7a69ea91894a03e312b48fab5a0bf619ca564934a8492e1
-
Filesize
49KB
MD5b53d2610cb25a65da0ad5a0a3cd4704a
SHA14f1f020386f344faf70dd6a5a9961da932a3616e
SHA256d52e78cd3873e0ed38247ec6d4d8896ae09d662ededafb59f8fee4b31db9faf2
SHA512fcc18212b75218e00ce0807f70785eec49cd55142767fc8003ee8c89138f986f1edc9d9ddf08631f14b645996662adfa82e7d0fe10975a01133bd96b1d508b1b
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d