Analysis
-
max time kernel
138s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
31/03/2025, 01:55
General
-
Target
2025-03-31_dbc6e16e0f7f4584138dcf46ecf2db8a_amadey_smoke-loader.exe
-
Size
27.2MB
-
MD5
dbc6e16e0f7f4584138dcf46ecf2db8a
-
SHA1
edbf12b60f7d35d0bc7767096a297c62309557f6
-
SHA256
872e4606ea71b5c7811031a0100c727d1c2a0e75e209a90bd8b57aa5e920e52e
-
SHA512
e5db101a001dfb262f62fa32cadee6a098a636bb58961a9c8148bff39190fe1fe7b22d67bce401e61effd5eae7394ab53a3e6be7849857923eb2e81a900dcd93
-
SSDEEP
786432:SsLxhasvvLNfpbN5aYgffb1LC9Akh800lYuL/4zwTfG:SuPLRf9faYgfZlcv8YCfG
Malware Config
Signatures
-
Detect PurpleFox Rootkit 5 IoCs
Detect PurpleFox Rootkit.
-
Gh0st RAT payload 5 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Purplefox family
-
Executes dropped EXE 3 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-31_dbc6e16e0f7f4584138dcf46ecf2db8a_amadey_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-31_dbc6e16e0f7f4584138dcf46ecf2db8a_amadey_smoke-loader.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÑéÖ¤.dllC:\Users\Admin\AppData\Local\Temp\ÑéÖ¤.dll2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\F2BA~1.DLL > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\Gwogw.exeC:\Windows\SysWOW64\Gwogw.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Gwogw.exeC:\Windows\SysWOW64\Gwogw.exe -acsi2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
396KB
MD598f86e6f155db914a696db2adf3a4f2e
SHA1c490f423ec6ee67d6038e4149e6a5b77e061d851
SHA2560e463e663d2f75b25228103b8cf10d61d5b8d88943c216337d29ba86d21f466c
SHA5128e2f142f2bce47b31473d489e2a84db1ec20d5a7a846c5912c1b3f4a336a28c20c10e21a6baee390b14fdf4fa36a8ec2b5fd2dbb19ae30371f3af7dc5b0c1e57
-
Filesize
27.6MB
-
Filesize
10.3MB
-
Filesize
27.6MB
-
Filesize
4KB
-
Filesize
10.3MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
404KB