Analysis
-
max time kernel
136s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2024 11:44
Static task
static1
Behavioral task
behavioral1
Sample
c7961a9dcce48cc239c0751e0ac766dc0ec05424b1e2cf4d9c62e257ba484a2d.exe
Resource
win7-20240903-en
General
-
Target
c7961a9dcce48cc239c0751e0ac766dc0ec05424b1e2cf4d9c62e257ba484a2d.exe
-
Size
491KB
-
MD5
9d56dd06dd5527d9936495dbd66dc72a
-
SHA1
4bd2649d02cb60b7fa3ec40007966d6ae56c2b87
-
SHA256
c7961a9dcce48cc239c0751e0ac766dc0ec05424b1e2cf4d9c62e257ba484a2d
-
SHA512
9a4aa46e3e4b95f03d25faf06c7aac6071e47610d61284795f715e7c2ece287928b083decda6552d3c0fa060918aee4b69c48f2b498a045c19141633342bb749
-
SSDEEP
6144:GpoMkequERu8qQ1fjYMMW9eKZH+IdISTUL24qL9cPKcPzR2Rr6lZv:oDR+u8pfjYMMWNvdhUSByFPzlv
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2268-2-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/2268-5-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/2268-3-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/2268-6-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/3176-17-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/812-25-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/812-23-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/3176-16-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/3176-14-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/3176-13-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral2/memory/3176-27-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 12 IoCs
resource yara_rule behavioral2/memory/2268-2-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/2268-5-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/2268-3-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/2268-6-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/3176-17-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/812-25-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/812-24-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/812-23-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/3176-16-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/3176-14-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/3176-13-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral2/memory/3176-27-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Executes dropped EXE 2 IoCs
pid Process 3176 Phxph.exe 812 Phxph.exe -
resource yara_rule behavioral2/memory/2268-2-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2268-0-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2268-5-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2268-3-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/2268-6-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/3176-11-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/3176-17-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/812-25-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/812-24-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/812-23-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/3176-16-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/3176-14-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/3176-13-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral2/memory/3176-27-0x0000000010000000-0x00000000101D0000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Phxph.exe c7961a9dcce48cc239c0751e0ac766dc0ec05424b1e2cf4d9c62e257ba484a2d.exe File opened for modification C:\Program Files\Phxph.exe c7961a9dcce48cc239c0751e0ac766dc0ec05424b1e2cf4d9c62e257ba484a2d.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c7961a9dcce48cc239c0751e0ac766dc0ec05424b1e2cf4d9c62e257ba484a2d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phxph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phxph.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4204 PING.EXE 2352 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4204 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2268 c7961a9dcce48cc239c0751e0ac766dc0ec05424b1e2cf4d9c62e257ba484a2d.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2352 2268 c7961a9dcce48cc239c0751e0ac766dc0ec05424b1e2cf4d9c62e257ba484a2d.exe 83 PID 2268 wrote to memory of 2352 2268 c7961a9dcce48cc239c0751e0ac766dc0ec05424b1e2cf4d9c62e257ba484a2d.exe 83 PID 2268 wrote to memory of 2352 2268 c7961a9dcce48cc239c0751e0ac766dc0ec05424b1e2cf4d9c62e257ba484a2d.exe 83 PID 3176 wrote to memory of 812 3176 Phxph.exe 84 PID 3176 wrote to memory of 812 3176 Phxph.exe 84 PID 3176 wrote to memory of 812 3176 Phxph.exe 84 PID 2352 wrote to memory of 4204 2352 cmd.exe 86 PID 2352 wrote to memory of 4204 2352 cmd.exe 86 PID 2352 wrote to memory of 4204 2352 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7961a9dcce48cc239c0751e0ac766dc0ec05424b1e2cf4d9c62e257ba484a2d.exe"C:\Users\Admin\AppData\Local\Temp\c7961a9dcce48cc239c0751e0ac766dc0ec05424b1e2cf4d9c62e257ba484a2d.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\C7961A~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4204
-
-
-
C:\Program Files\Phxph.exe"C:\\Program Files\\Phxph.exe" -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Program Files\Phxph.exe"C:\Program Files\Phxph.exe" -acsi2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:812
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
491KB
MD59d56dd06dd5527d9936495dbd66dc72a
SHA14bd2649d02cb60b7fa3ec40007966d6ae56c2b87
SHA256c7961a9dcce48cc239c0751e0ac766dc0ec05424b1e2cf4d9c62e257ba484a2d
SHA5129a4aa46e3e4b95f03d25faf06c7aac6071e47610d61284795f715e7c2ece287928b083decda6552d3c0fa060918aee4b69c48f2b498a045c19141633342bb749