Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2024 01:22
Behavioral task
behavioral1
Sample
0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe
Resource
win7-20240708-en
General
-
Target
0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe
-
Size
1.2MB
-
MD5
f31ff47db45f50bffeea845cd3d67d1e
-
SHA1
54de6a40b29ef3aeeb4474ced08cf125e4567da3
-
SHA256
0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401
-
SHA512
1f7b1668d2c7769d63e5a79e7e2c97389e401dde8014d899451c479eee316664b3f530e1c1c1340a7a6f3b0c780f76d6c6a8c4dd112932a5465c6e7c1caea18e
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtia:WIwgMEuy+inDfp3/XoCw57XYBwKa
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4084-25-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral2/memory/4084-26-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral2/memory/3304-34-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral2/memory/3304-33-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral2/memory/2440-44-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral2/memory/2440-48-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral2/memory/2440-51-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 8 IoCs
resource yara_rule behavioral2/files/0x0007000000023ca0-17.dat family_gh0strat behavioral2/memory/4084-25-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral2/memory/4084-26-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral2/memory/3304-34-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral2/memory/3304-33-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral2/memory/2440-44-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral2/memory/2440-48-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral2/memory/2440-51-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys Ghiya.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Ghiya.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.lnk 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe -
Executes dropped EXE 5 IoCs
pid Process 3560 AK47.exe 4776 AK47.exe 4084 AK74.exe 3304 Ghiya.exe 2440 Ghiya.exe -
Loads dropped DLL 1 IoCs
pid Process 4776 AK47.exe -
resource yara_rule behavioral2/memory/1004-0-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/memory/1004-1-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/files/0x0009000000023cab-54.dat vmprotect behavioral2/memory/1004-60-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/memory/1004-63-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/memory/1004-66-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/memory/1004-70-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/memory/1004-73-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/memory/1004-76-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral2/memory/1004-79-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\360safo = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchcst.exe" 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\240619046.txt AK47.exe File created C:\Windows\SysWOW64\240619046.txt AK47.exe File created C:\Windows\SysWOW64\Ghiya.exe AK74.exe File opened for modification C:\Windows\SysWOW64\Ghiya.exe AK74.exe -
resource yara_rule behavioral2/memory/4084-25-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/4084-23-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/4084-26-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/3304-34-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/3304-33-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/3304-31-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/2440-44-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/2440-48-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral2/memory/2440-51-0x0000000010000000-0x00000000101BA000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2924 3560 WerFault.exe 85 1456 4776 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AK47.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AK47.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AK74.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghiya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 212 cmd.exe 3044 PING.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3044 PING.EXE -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2440 Ghiya.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4084 AK74.exe Token: SeLoadDriverPrivilege 2440 Ghiya.exe Token: 33 2440 Ghiya.exe Token: SeIncBasePriorityPrivilege 2440 Ghiya.exe Token: 33 2440 Ghiya.exe Token: SeIncBasePriorityPrivilege 2440 Ghiya.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1004 wrote to memory of 3560 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 85 PID 1004 wrote to memory of 3560 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 85 PID 1004 wrote to memory of 3560 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 85 PID 1004 wrote to memory of 4776 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 86 PID 1004 wrote to memory of 4776 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 86 PID 1004 wrote to memory of 4776 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 86 PID 1004 wrote to memory of 4084 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 93 PID 1004 wrote to memory of 4084 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 93 PID 1004 wrote to memory of 4084 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 93 PID 4084 wrote to memory of 212 4084 AK74.exe 95 PID 4084 wrote to memory of 212 4084 AK74.exe 95 PID 4084 wrote to memory of 212 4084 AK74.exe 95 PID 3304 wrote to memory of 2440 3304 Ghiya.exe 96 PID 3304 wrote to memory of 2440 3304 Ghiya.exe 96 PID 3304 wrote to memory of 2440 3304 Ghiya.exe 96 PID 1004 wrote to memory of 3028 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 97 PID 1004 wrote to memory of 3028 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 97 PID 1004 wrote to memory of 3028 1004 0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe 97 PID 212 wrote to memory of 3044 212 cmd.exe 100 PID 212 wrote to memory of 3044 212 cmd.exe 100 PID 212 wrote to memory of 3044 212 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe"C:\Users\Admin\AppData\Local\Temp\0067971e9e4f46b0612f5805d542f7fe1ea864f0a34baaefc2a5fb3e91006401.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\AK47.exe"C:\Users\Admin\AppData\Local\Temp\AK47.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 4883⤵
- Program crash
PID:2924
-
-
-
C:\Users\Admin\AppData\Local\Temp\AK47.exeC:\Users\Admin\AppData\Local\Temp\\AK47.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 4243⤵
- Program crash
PID:1456
-
-
-
C:\Users\Admin\AppData\Local\Temp\AK74.exeC:\Users\Admin\AppData\Local\Temp\\AK74.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\AK74.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3044
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
PID:3028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3560 -ip 35601⤵PID:3976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4776 -ip 47761⤵PID:3584
-
C:\Windows\SysWOW64\Ghiya.exeC:\Windows\SysWOW64\Ghiya.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\Ghiya.exeC:\Windows\SysWOW64\Ghiya.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5423eb994ed553294f8a6813619b8da87
SHA1eca6a16ccd13adcfc27bc1041ddef97ec8081255
SHA256050b4f2d5ae8eaecd414318dc8e222a56f169626da6ca8feb7edd78e8b1f0218
SHA512fab0a9af8031c242c486de373df7277c8b0e39f7a0c9c2ac2e385dbd3ea67be16e91b128287634f76131e5264149ab1b452cd21df4c4895e8c4efc8d8cf99095
-
Filesize
400KB
MD5b0998aa7d5071d33daa5b60b9c3c9735
SHA19365a1ff0c6de244d6f36c8d84072cc916665d3c
SHA2563080b6bb456564899b0d99d4131bd6a0b284d31f7d80ef773e4872d94048d49a
SHA512308c13cda9fea39b980ae686f44afd9090e9cb8970fffc4436320e0d09a31aee5e656914e0121fe888098a14c52749716fa04980396fd6ac70a88c11cbb6b850
-
Filesize
92B
MD529ce53e2a4a446614ccc8d64d346bde4
SHA139a7aa5cc1124842aa0c25abb16ea94452125cbe
SHA25656225be6838bc6e93ea215891eacf28844ae27a9f8b2b29bf19d3a8c2b1f58df
SHA512b2c5a2708c427171a5715801f8ea733ffe88d73aaaaf59c5c752ea32cbe7aae8526cc26eabe84ad5043174c0c69b1d6b15a9fb125c15accfac3462d5d08a0faa
-
Filesize
753B
MD55dc57c0f103daed2069eb9dccb52dcc9
SHA105d27a1a05cfb8fa386bdb8d362fd32048f640cb
SHA256383e9f5355de2334e91cf878f18edb6149fbb73a8acf82d1b7ca461e2de3466c
SHA5120efcfe79087568168471d3c2f438cb3f9cd783aaaa4fee7019331ea168d3a5870a81e19291b51a42264ca036f9467436f8fa1a9ad0a1905a077d5eab73d212f9
-
Filesize
1.2MB
MD599afad40869034ac16e2dd6e75f9a0de
SHA1087cefbc1f5864e9a701d02b79ca39db6fa92689
SHA25692db2bd5f87f2a8d260e76d322291976cd1a9689b315c8cd321d890aaea1f5d1
SHA512adfe3403aedc0f571ab3c2778969312ef75618d252ec37bcf7ace113c178472b2214c09811b87c3978ee03acdbe2b09d0abaa4974b894e083a4b794f052d11a9
-
Filesize
49KB
MD58e5e59ade4c2b80bc37e07cdae322c00
SHA1667a11f93e6a5054eab6ae56ea7ba6cfdd16c810
SHA256196acd333d4bdfcad41a9778b3b5144f66359ac02cfe318c28f8301ebca17df1
SHA5123fa1faed65dd89c5c23cd5cbd4bd12a0112633031817664717fff9b7110a672c861ff344d9e1619ebc80b6f0626b96751dc3643c0ca824fb1c9090ba08b6ed29