Analysis
-
max time kernel
97s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/12/2024, 20:40
Static task
static1
Behavioral task
behavioral1
Sample
a6bf02a1c601328c60491a45a0cacb86d9405cc0b651142d5b73f29b19520b0a.exe
Resource
win7-20240903-en
General
-
Target
a6bf02a1c601328c60491a45a0cacb86d9405cc0b651142d5b73f29b19520b0a.exe
-
Size
1.4MB
-
MD5
b0446231b4bd01e19e524dbd1bc77c38
-
SHA1
18ec565cf16d7f28da0bffbfd25caec2deddee13
-
SHA256
a6bf02a1c601328c60491a45a0cacb86d9405cc0b651142d5b73f29b19520b0a
-
SHA512
39770f235bace060eb236064782b7b7c87ade2f9cabdcb2fc35ab3d61a78bea24430f017f82ae1752199b1324a6a4a6fdfb3b0625cd07ddfc54063b4f8f8e8a3
-
SSDEEP
24576:F39WkOyHutimZ9VSly2hVvHW6qMnSbTBBhBMN6:59qHPkVOBTK6
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4932-0-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral2/memory/4660-10-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral2/memory/912-17-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral2/memory/4932-0-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral2/memory/4660-10-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral2/memory/912-17-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys Skcsk.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Skcsk.exe -
Executes dropped EXE 2 IoCs
pid Process 4660 Skcsk.exe 912 Skcsk.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Skcsk.exe a6bf02a1c601328c60491a45a0cacb86d9405cc0b651142d5b73f29b19520b0a.exe File opened for modification C:\Windows\SysWOW64\Skcsk.exe a6bf02a1c601328c60491a45a0cacb86d9405cc0b651142d5b73f29b19520b0a.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Skcsk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a6bf02a1c601328c60491a45a0cacb86d9405cc0b651142d5b73f29b19520b0a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Skcsk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1684 cmd.exe 744 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 744 PING.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 912 Skcsk.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4932 a6bf02a1c601328c60491a45a0cacb86d9405cc0b651142d5b73f29b19520b0a.exe Token: SeLoadDriverPrivilege 912 Skcsk.exe Token: 33 912 Skcsk.exe Token: SeIncBasePriorityPrivilege 912 Skcsk.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4932 wrote to memory of 1684 4932 a6bf02a1c601328c60491a45a0cacb86d9405cc0b651142d5b73f29b19520b0a.exe 83 PID 4932 wrote to memory of 1684 4932 a6bf02a1c601328c60491a45a0cacb86d9405cc0b651142d5b73f29b19520b0a.exe 83 PID 4932 wrote to memory of 1684 4932 a6bf02a1c601328c60491a45a0cacb86d9405cc0b651142d5b73f29b19520b0a.exe 83 PID 1684 wrote to memory of 744 1684 cmd.exe 85 PID 1684 wrote to memory of 744 1684 cmd.exe 85 PID 1684 wrote to memory of 744 1684 cmd.exe 85 PID 4660 wrote to memory of 912 4660 Skcsk.exe 86 PID 4660 wrote to memory of 912 4660 Skcsk.exe 86 PID 4660 wrote to memory of 912 4660 Skcsk.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6bf02a1c601328c60491a45a0cacb86d9405cc0b651142d5b73f29b19520b0a.exe"C:\Users\Admin\AppData\Local\Temp\a6bf02a1c601328c60491a45a0cacb86d9405cc0b651142d5b73f29b19520b0a.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\A6BF02~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:744
-
-
-
C:\Windows\SysWOW64\Skcsk.exeC:\Windows\SysWOW64\Skcsk.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\Skcsk.exeC:\Windows\SysWOW64\Skcsk.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:912
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5b0446231b4bd01e19e524dbd1bc77c38
SHA118ec565cf16d7f28da0bffbfd25caec2deddee13
SHA256a6bf02a1c601328c60491a45a0cacb86d9405cc0b651142d5b73f29b19520b0a
SHA51239770f235bace060eb236064782b7b7c87ade2f9cabdcb2fc35ab3d61a78bea24430f017f82ae1752199b1324a6a4a6fdfb3b0625cd07ddfc54063b4f8f8e8a3