Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
01-01-2025 13:49
Behavioral task
behavioral1
Sample
c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe
Resource
win7-20241023-en
General
-
Target
c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe
-
Size
1.2MB
-
MD5
dd4a96df7d5b3e025d6ed86d6669dd9f
-
SHA1
85f901f01b5669e11c1f7001392b778eff0653b0
-
SHA256
c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399
-
SHA512
881317e539f576308b627e7325e1eda45fad5058ddab8f5ca13133d7a9c58a64ac0be79fa54438d560768630b9f442e0e7f74b431ec145e55090f72ae0602515
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiT:WIwgMEuy+inDfp3/XoCw57XYBwKT
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2572-23-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/2572-24-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/2888-44-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/2888-48-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/2888-49-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 6 IoCs
resource yara_rule behavioral1/files/0x0008000000015d59-15.dat family_gh0strat behavioral1/memory/2572-23-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/2572-24-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/2888-44-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/2888-48-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/2888-49-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys Ghiya.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Ghiya.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.lnk c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe -
Executes dropped EXE 5 IoCs
pid Process 1236 AK47.exe 796 AK47.exe 2572 AK74.exe 2496 Ghiya.exe 2888 Ghiya.exe -
Loads dropped DLL 7 IoCs
pid Process 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 1236 AK47.exe 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 2496 Ghiya.exe 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe -
resource yara_rule behavioral1/memory/2124-0-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/2124-1-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/files/0x0007000000015ec4-53.dat vmprotect behavioral1/memory/2124-62-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/2124-66-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/2124-69-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/2124-73-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/2124-76-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/2124-79-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/2124-82-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\360safo = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchcst.exe" c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\Ghiya.exe AK74.exe File opened for modification C:\Windows\SysWOW64\Ghiya.exe AK74.exe File created C:\Windows\SysWOW64\259431628.txt AK47.exe File created C:\Windows\SysWOW64\259431628.txt AK47.exe -
resource yara_rule behavioral1/memory/2572-21-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2572-23-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2572-24-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2888-44-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2888-48-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2888-49-0x0000000010000000-0x00000000101BA000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghiya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AK47.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AK47.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AK74.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2868 cmd.exe 2880 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2880 PING.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2888 Ghiya.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2572 AK74.exe Token: SeLoadDriverPrivilege 2888 Ghiya.exe Token: 33 2888 Ghiya.exe Token: SeIncBasePriorityPrivilege 2888 Ghiya.exe Token: 33 2888 Ghiya.exe Token: SeIncBasePriorityPrivilege 2888 Ghiya.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2124 wrote to memory of 1236 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 30 PID 2124 wrote to memory of 1236 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 30 PID 2124 wrote to memory of 1236 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 30 PID 2124 wrote to memory of 1236 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 30 PID 2124 wrote to memory of 796 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 31 PID 2124 wrote to memory of 796 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 31 PID 2124 wrote to memory of 796 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 31 PID 2124 wrote to memory of 796 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 31 PID 2124 wrote to memory of 2572 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 32 PID 2124 wrote to memory of 2572 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 32 PID 2124 wrote to memory of 2572 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 32 PID 2124 wrote to memory of 2572 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 32 PID 2124 wrote to memory of 2572 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 32 PID 2124 wrote to memory of 2572 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 32 PID 2124 wrote to memory of 2572 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 32 PID 2572 wrote to memory of 2868 2572 AK74.exe 34 PID 2572 wrote to memory of 2868 2572 AK74.exe 34 PID 2572 wrote to memory of 2868 2572 AK74.exe 34 PID 2572 wrote to memory of 2868 2572 AK74.exe 34 PID 2496 wrote to memory of 2888 2496 Ghiya.exe 35 PID 2496 wrote to memory of 2888 2496 Ghiya.exe 35 PID 2496 wrote to memory of 2888 2496 Ghiya.exe 35 PID 2496 wrote to memory of 2888 2496 Ghiya.exe 35 PID 2496 wrote to memory of 2888 2496 Ghiya.exe 35 PID 2496 wrote to memory of 2888 2496 Ghiya.exe 35 PID 2496 wrote to memory of 2888 2496 Ghiya.exe 35 PID 2868 wrote to memory of 2880 2868 cmd.exe 37 PID 2868 wrote to memory of 2880 2868 cmd.exe 37 PID 2868 wrote to memory of 2880 2868 cmd.exe 37 PID 2868 wrote to memory of 2880 2868 cmd.exe 37 PID 2124 wrote to memory of 2724 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 38 PID 2124 wrote to memory of 2724 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 38 PID 2124 wrote to memory of 2724 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 38 PID 2124 wrote to memory of 2724 2124 c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe"C:\Users\Admin\AppData\Local\Temp\c8c701f1d46835c656c6cf88212411b77f0925f1f01df966b069e1385992a399.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\AK47.exe"C:\Users\Admin\AppData\Local\Temp\AK47.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1236
-
-
C:\Users\Admin\AppData\Local\Temp\AK47.exeC:\Users\Admin\AppData\Local\Temp\\AK47.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:796
-
-
C:\Users\Admin\AppData\Local\Temp\AK74.exeC:\Users\Admin\AppData\Local\Temp\\AK74.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\AK74.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2880
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
PID:2724
-
-
C:\Windows\SysWOW64\Ghiya.exeC:\Windows\SysWOW64\Ghiya.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\Ghiya.exeC:\Windows\SysWOW64\Ghiya.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD529ce53e2a4a446614ccc8d64d346bde4
SHA139a7aa5cc1124842aa0c25abb16ea94452125cbe
SHA25656225be6838bc6e93ea215891eacf28844ae27a9f8b2b29bf19d3a8c2b1f58df
SHA512b2c5a2708c427171a5715801f8ea733ffe88d73aaaaf59c5c752ea32cbe7aae8526cc26eabe84ad5043174c0c69b1d6b15a9fb125c15accfac3462d5d08a0faa
-
Filesize
753B
MD5508facecb896ccffa37c40f5253b443c
SHA1eddad85665007789dc8a0a820f6a8bc30559254f
SHA25658cc7245c174b0031670406d539ac949bcab970806aaefa5b20d8e5d5c2c14b8
SHA51235d6cc6b7cf507b1e79d9f0ede1818bbb79a5d9fcf85feae3ded1c3b3fc6bf5bd18871a256ef4baa8388ef9d0407fcf1b44c383026a4f0d01c93e0875a602d34
-
Filesize
91KB
MD5423eb994ed553294f8a6813619b8da87
SHA1eca6a16ccd13adcfc27bc1041ddef97ec8081255
SHA256050b4f2d5ae8eaecd414318dc8e222a56f169626da6ca8feb7edd78e8b1f0218
SHA512fab0a9af8031c242c486de373df7277c8b0e39f7a0c9c2ac2e385dbd3ea67be16e91b128287634f76131e5264149ab1b452cd21df4c4895e8c4efc8d8cf99095
-
Filesize
400KB
MD5b0998aa7d5071d33daa5b60b9c3c9735
SHA19365a1ff0c6de244d6f36c8d84072cc916665d3c
SHA2563080b6bb456564899b0d99d4131bd6a0b284d31f7d80ef773e4872d94048d49a
SHA512308c13cda9fea39b980ae686f44afd9090e9cb8970fffc4436320e0d09a31aee5e656914e0121fe888098a14c52749716fa04980396fd6ac70a88c11cbb6b850
-
Filesize
1.2MB
MD55db1eed02ef71a0161e2a6dd10e15d87
SHA1e8ca43ef73bba75dc9f01448732bc46f4c8c4671
SHA2565e22edc403c85ca8bf98b6d1b2184756c9d5780d90e1a397680ec8c381390974
SHA512c101f7441b171de048e8a3f275f671beff986728c5bc950e4c51d31a25fd5f4da38f4371ea39507dd94e34467fe5f55da08a83aaa987b6e477243c62cd091ca2
-
Filesize
49KB
MD5c67ede5b8fa63b1986ecf0368610b115
SHA1c94771b12dfda15949ea5737cb4a7f3553f8c144
SHA256b63b3f8c10ca4157e408d7e4ee87b3840272f5d5d83d5c558c9dcbe9d83f4690
SHA512efc703ee36d1e3d506e46599a4bb671e756ebd4025d08d191059f3531a05fd6d694cad8de96cdf46cbb2c8dd09807202099241303c8fa24d9dd6749d4cc953fd