Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/01/2025, 12:39
General
-
Target
2632b2763039727d4647654118a40e18d4cc6c655bbcda1e196472dd279412d3.exe
-
Size
600KB
-
MD5
24760af28ba548c76203e289ac49c02e
-
SHA1
39938a8643b9f93730bc9ec00d338e6684cacfbc
-
SHA256
2632b2763039727d4647654118a40e18d4cc6c655bbcda1e196472dd279412d3
-
SHA512
acde5f749bd63db561af132daefd51a67022455c0429e0a14f906297ebfcd8ad79124d5dcce1e0d76f4cdc0e801815b8eeb369821526df12ded0e364492dbe03
-
SSDEEP
12288:Li2cAro2HQVWAHkFSq2hAWJYlMUtrxlyuJVRe8ymEP1n/:Li2Tro2H2HESq2eWJ6MQjySjy9n
Malware Config
Signatures
-
Detect PurpleFox Rootkit 9 IoCs
Detect PurpleFox Rootkit.
-
Gh0st RAT payload 9 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Purplefox family
-
Drops file in Drivers directory 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2632b2763039727d4647654118a40e18d4cc6c655bbcda1e196472dd279412d3.exe"C:\Users\Admin\AppData\Local\Temp\2632b2763039727d4647654118a40e18d4cc6c655bbcda1e196472dd279412d3.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_2632b2763039727d4647654118a40e18d4cc6c655bbcda1e196472dd279412d3.exeC:\Users\Admin\AppData\Local\Temp\HD_2632b2763039727d4647654118a40e18d4cc6c655bbcda1e196472dd279412d3.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5fc2d5ceed229f68cbf89ee8f7fb151bd
SHA121789004bac3d4d7095ecdca47b0039bbb4e25ec
SHA256b89e36118bde8b0ee040e71e9237baab08b33aec56fa5b475ac32e93998aab6c
SHA5129d475b87c4cfca116a91bcb5e3f8bb7345707e37efc683e12c6eb1dc77b62b5451d9581e4bf85bd643e6a01bf64bdc8150409ca47a2a3bb97dbff824a5d867c5
-
Filesize
32KB
MD5b9a724abbba96c6b4c0d68f781f00257
SHA1ff95c918708cf51d9110f3d9981d466903c1a222
SHA25673c2f9b8e652699c583e469059c41f05c95206a01d215896c49355f78d0d7fb4
SHA51294fd7eb39db47c0e4a1117284eca21dcf3f7f26fb551d2bcef3655ed475fb457f8a27ecae0cedac7f273720bcaa478fd6bab5b7ff4b514b8c87b17a89f935dca
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB