Analysis
-
max time kernel
0s -
max time network
4s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/03/2025, 02:14
Behavioral task
behavioral1
Sample
69c35d7e9263cbd972093db901f3fc8460cbc81749564e40262f7ca5945bf661.exe
Resource
win7-20240903-en
General
-
Target
69c35d7e9263cbd972093db901f3fc8460cbc81749564e40262f7ca5945bf661.exe
-
Size
1.2MB
-
MD5
c1599d973af9fcdeb40aa72ffeaaaa72
-
SHA1
28cee9027afc64ba28c6ad90583bcafd5f2127d1
-
SHA256
69c35d7e9263cbd972093db901f3fc8460cbc81749564e40262f7ca5945bf661
-
SHA512
ce2178c9dcc14561259531fd9f5e265ccf9afa306c2c1779de0a2ad04116dc8f8bca37981fdf1f32590473fd86c87c422dd37c229fbbea9f0372cb7da638bdc3
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtii:WIwgMEuy+inDfp3/XoCw57XYBwKi
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2864-26-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/2864-25-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/2944-51-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/2944-55-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/2944-56-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 6 IoCs
resource yara_rule behavioral1/files/0x0008000000015d6e-14.dat family_gh0strat behavioral1/memory/2864-26-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/2864-25-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/2944-51-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/2944-55-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/2944-56-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
resource yara_rule behavioral1/memory/3032-0-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/3032-1-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect -
resource yara_rule behavioral1/memory/2864-26-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2864-23-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2864-25-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2944-51-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2944-55-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2944-56-0x0000000010000000-0x00000000101BA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69c35d7e9263cbd972093db901f3fc8460cbc81749564e40262f7ca5945bf661.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2940 cmd.exe 1924 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1924 PING.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3032 69c35d7e9263cbd972093db901f3fc8460cbc81749564e40262f7ca5945bf661.exe 3032 69c35d7e9263cbd972093db901f3fc8460cbc81749564e40262f7ca5945bf661.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c35d7e9263cbd972093db901f3fc8460cbc81749564e40262f7ca5945bf661.exe"C:\Users\Admin\AppData\Local\Temp\69c35d7e9263cbd972093db901f3fc8460cbc81749564e40262f7ca5945bf661.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\AK47.exe"C:\Users\Admin\AppData\Local\Temp\AK47.exe"2⤵PID:2880
-
-
C:\Users\Admin\AppData\Local\Temp\AK47.exeC:\Users\Admin\AppData\Local\Temp\\AK47.exe2⤵PID:2648
-
-
C:\Users\Admin\AppData\Local\Temp\AK74.exeC:\Users\Admin\AppData\Local\Temp\\AK74.exe2⤵PID:2864
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\AK74.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:2940 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1924
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵PID:2512
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵PID:2980
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵PID:2696
-
C:\Windows\SysWOW64\Ghiya.exeC:\Windows\SysWOW64\Ghiya.exe -auto1⤵PID:2536
-
C:\Windows\SysWOW64\Ghiya.exeC:\Windows\SysWOW64\Ghiya.exe -acsi2⤵PID:2944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD51883a41328509b0ac1d976bd3227062f
SHA1f29eb9d6fe33b64dce5ff53b8ad967b2aa25df9f
SHA2566f0158c1bf08af048a0c7af9cf0b7182ba42fe81a2ebdc2a33f7a065c60a5b71
SHA5124ddcd99a8651f05316dfee452b1c3425a04e13ba37ad5b4ec596d76c6f0d1c199a0239b5b3895d1f7c44779bd57cee019da5a92c5806aed5055428714a931f03
-
Filesize
91KB
MD5423eb994ed553294f8a6813619b8da87
SHA1eca6a16ccd13adcfc27bc1041ddef97ec8081255
SHA256050b4f2d5ae8eaecd414318dc8e222a56f169626da6ca8feb7edd78e8b1f0218
SHA512fab0a9af8031c242c486de373df7277c8b0e39f7a0c9c2ac2e385dbd3ea67be16e91b128287634f76131e5264149ab1b452cd21df4c4895e8c4efc8d8cf99095
-
Filesize
400KB
MD5b0998aa7d5071d33daa5b60b9c3c9735
SHA19365a1ff0c6de244d6f36c8d84072cc916665d3c
SHA2563080b6bb456564899b0d99d4131bd6a0b284d31f7d80ef773e4872d94048d49a
SHA512308c13cda9fea39b980ae686f44afd9090e9cb8970fffc4436320e0d09a31aee5e656914e0121fe888098a14c52749716fa04980396fd6ac70a88c11cbb6b850