Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
09-02-2025 06:06
General
-
Target
848e49a46ec1b81b9c0c7dadf22b48fa8171d0e20f7bef00364c305f4bdc952b.exe
-
Size
13.8MB
-
MD5
6452c8d8bf44dbee3f84f8a1de05bb25
-
SHA1
9dbf2336ba6b537b425cbc9994d47f18d2570577
-
SHA256
848e49a46ec1b81b9c0c7dadf22b48fa8171d0e20f7bef00364c305f4bdc952b
-
SHA512
33586220ea18dbd3201780d099005c76c0c951f2bcac9926a0f5ee7636da2eb7339e6bb8571b7ba55f4806586327a20a54a481f372350d0cdc8cf3fcde285fa9
-
SSDEEP
393216:2vRtlptVYmfr7yBG/41w0vJROFTfCTKw27J:21pttD7yBG/OTvJRGCN27J
Malware Config
Signatures
-
Detect PurpleFox Rootkit 10 IoCs
Detect PurpleFox Rootkit.
-
Gh0st RAT payload 10 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Purplefox family
-
Drops file in Drivers directory 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
-
UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\848e49a46ec1b81b9c0c7dadf22b48fa8171d0e20f7bef00364c305f4bdc952b.exe"C:\Users\Admin\AppData\Local\Temp\848e49a46ec1b81b9c0c7dadf22b48fa8171d0e20f7bef00364c305f4bdc952b.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_848e49a46ec1b81b9c0c7dadf22b48fa8171d0e20f7bef00364c305f4bdc952b.exeC:\Users\Admin\AppData\Local\Temp\HD_848e49a46ec1b81b9c0c7dadf22b48fa8171d0e20f7bef00364c305f4bdc952b.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{3162FBF2-330A-41B9-9B1C-F561234F7033}\.cr\HD_848e49a46ec1b81b9c0c7dadf22b48fa8171d0e20f7bef00364c305f4bdc952b.exe"C:\Windows\Temp\{3162FBF2-330A-41B9-9B1C-F561234F7033}\.cr\HD_848e49a46ec1b81b9c0c7dadf22b48fa8171d0e20f7bef00364c305f4bdc952b.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\HD_848e49a46ec1b81b9c0c7dadf22b48fa8171d0e20f7bef00364c305f4bdc952b.exe" -burn.filehandle.attached=688 -burn.filehandle.self=6923⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.2MB
MD5e78b6357c9d1a1873071f16bcae86df3
SHA1703862dcfead009f8811c23b5219c1fac86ff6c4
SHA256f65e95b69d51771f74ae31c6e8a4b5027ef5ddb4ddd8600481587c8aaf8a9d90
SHA5129ee3bb66815f008c8214100e16ca6c8c7b4e8bc2a4ecd0ac1b42fa79b3bf9a187fea499edd88424e13ee60d8c506151c97de46d5603e63611d79ed219d1f60d1
-
Filesize
604KB
MD5e382e0f794e90bae0baad8412f77c23d
SHA11d52a424962f3deab2374a5dd7052bbe35703a1a
SHA2564c0121f4b1fd3c3a906e08b60c245e56077019b333d240a0508f59c3500a0f20
SHA512405fea32ee0a3b9136efe406911a5d637ea16db503abc80c48142321592f9fae26552f2fabb1b5c29542381022bf78043eb35eabdf10b0e65c6bf4c8c66beb14
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
634KB
MD5415e8d504ea08ee2d8515fe87b820910
SHA1e90f591c730bd39b8343ca3689b2c0ee85aaea5f
SHA256e0e642106c94fd585782b75d1f942872d2bf99d870bed4216e5001e4ba3374c0
SHA512e51f185c0e9d3eb4950a4c615285c6610a4977a696ed9f3297a551835097b2122566122231437002c82e2c5cf72a7a8f67362bff16b24c0abe05fe35dddbf6a1
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
