Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2023, 17:55 UTC

General

  • Target

    d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe

  • Size

    4.2MB

  • MD5

    282a98e41f54a76d34fcefc86f623a7a

  • SHA1

    6bc551e62c7d899df7ff19b776f81524d66f48b6

  • SHA256

    d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436

  • SHA512

    eeebb2c37ffa3e45fa40fefdd13d33343132e1cda673c4de93fc2211f3458b81026bcbfad4e610c8c81856121351d2d9e0616232c441e91a2ae1a9aa8fc8b804

  • SSDEEP

    49152:K09XJt4HIN2H2tFvduySUbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8R:LZJt4HINy2LkUbXsPN5kiQaZ56

Malware Config

Signatures

  • Detect PurpleFox Rootkit 10 IoCs

    Detect PurpleFox Rootkit.

  • Gh0st RAT payload 12 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe
    "C:\Users\Admin\AppData\Local\Temp\d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Users\Admin\AppData\Local\Temp\RVN.exe
      C:\Users\Admin\AppData\Local\Temp\\RVN.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5116
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1916
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:4700
    • C:\Users\Admin\AppData\Local\Temp\HD_d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe
      C:\Users\Admin\AppData\Local\Temp\HD_d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe
      2⤵
      • Executes dropped EXE
      PID:504
  • C:\Windows\SysWOW64\TXPlatforn.exe
    C:\Windows\SysWOW64\TXPlatforn.exe -auto
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3928
    • C:\Windows\SysWOW64\TXPlatforn.exe
      C:\Windows\SysWOW64\TXPlatforn.exe -acsi
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Executes dropped EXE
      • Suspicious behavior: LoadsDriver
      • Suspicious use of AdjustPrivilegeToken
      PID:3944

Network

  • flag-us
    DNS
    146.78.124.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    146.78.124.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    126.23.238.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    126.23.238.8.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    hackerinvasion.f3322.net
    TXPlatforn.exe
    Remote address:
    8.8.8.8:53
    Request
    hackerinvasion.f3322.net
    IN A
    Response
    hackerinvasion.f3322.net
    IN A
    127.0.0.1
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    208.194.73.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    208.194.73.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    hackerinvasion.f3322.net
    TXPlatforn.exe
    Remote address:
    8.8.8.8:53
    Request
    hackerinvasion.f3322.net
    IN A
    Response
    hackerinvasion.f3322.net
    IN A
    127.0.0.1
  • flag-us
    DNS
    0.77.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.77.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    89.16.208.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    89.16.208.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    hackerinvasion.f3322.net
    TXPlatforn.exe
    Remote address:
    8.8.8.8:53
    Request
    hackerinvasion.f3322.net
    IN A
    Response
    hackerinvasion.f3322.net
    IN A
    127.0.0.1
  • 127.0.0.1:6066
    TXPlatforn.exe
  • 127.0.0.1:6066
    TXPlatforn.exe
  • 127.0.0.1:6066
    TXPlatforn.exe
  • 127.0.0.1:6066
    TXPlatforn.exe
  • 127.0.0.1:6066
    TXPlatforn.exe
  • 8.8.8.8:53
    146.78.124.51.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    146.78.124.51.in-addr.arpa

  • 8.8.8.8:53
    126.23.238.8.in-addr.arpa
    dns
    71 B
    125 B
    1
    1

    DNS Request

    126.23.238.8.in-addr.arpa

  • 8.8.8.8:53
    hackerinvasion.f3322.net
    dns
    TXPlatforn.exe
    70 B
    86 B
    1
    1

    DNS Request

    hackerinvasion.f3322.net

    DNS Response

    127.0.0.1

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    208.194.73.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    208.194.73.20.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    183.59.114.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    183.59.114.20.in-addr.arpa

  • 8.8.8.8:53
    hackerinvasion.f3322.net
    dns
    TXPlatforn.exe
    70 B
    86 B
    1
    1

    DNS Request

    hackerinvasion.f3322.net

    DNS Response

    127.0.0.1

  • 8.8.8.8:53
    0.77.109.52.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    0.77.109.52.in-addr.arpa

  • 8.8.8.8:53
    89.16.208.104.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    89.16.208.104.in-addr.arpa

  • 8.8.8.8:53
    hackerinvasion.f3322.net
    dns
    TXPlatforn.exe
    70 B
    86 B
    1
    1

    DNS Request

    hackerinvasion.f3322.net

    DNS Response

    127.0.0.1

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\HD_X.dat

    Filesize

    1.1MB

    MD5

    ca0aaa0529dfe4d25233cb91c86adc85

    SHA1

    ce2a1d6eef2609552eefbdb2ad3ebf93364ed07e

    SHA256

    7c8407fd0e53ed680ca6b02a7e68e88b76495b14ce4baa46d290b91492003fe0

    SHA512

    d3aa29f5792240610e70fd15bf1e8fe177912984fee19478ea2e81cc77595c8503e17b108344b600cc32b8e288d831dc27d860616c0c84347d0a09b4900b82ee

  • C:\Users\Admin\AppData\Local\Temp\HD_d2a4facf24f3da8e6385bfbad88bb4468854a0a6cd5a35f7022fb8435f1cf436.exe

    Filesize

    3.1MB

    MD5

    fb083acd60fe5c3156dc25442be815e3

    SHA1

    61df59b8f3ebd8b3d29ca3aedc4995e23cacf6d8

    SHA256

    f130b3789962d5c8b59aa250d6f26ad5945928f3905b32bf65aa7bd30348a794

    SHA512

    7147337d2c1006bb15cfa967c9eea6826b63c8d343f866e7454d7368d25019f39e52cf179500810834244c3ca9644d6c0df0b2c3128a9051e9ee6b428fa926f6

  • C:\Users\Admin\AppData\Local\Temp\RVN.exe

    Filesize

    377KB

    MD5

    80ade1893dec9cab7f2e63538a464fcc

    SHA1

    c06614da33a65eddb506db00a124a3fc3f5be02e

    SHA256

    57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

    SHA512

    fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

  • C:\Users\Admin\AppData\Local\Temp\RVN.exe

    Filesize

    377KB

    MD5

    80ade1893dec9cab7f2e63538a464fcc

    SHA1

    c06614da33a65eddb506db00a124a3fc3f5be02e

    SHA256

    57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

    SHA512

    fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

  • C:\Windows\SysWOW64\TXPlatforn.exe

    Filesize

    377KB

    MD5

    80ade1893dec9cab7f2e63538a464fcc

    SHA1

    c06614da33a65eddb506db00a124a3fc3f5be02e

    SHA256

    57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

    SHA512

    fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

  • C:\Windows\SysWOW64\TXPlatforn.exe

    Filesize

    377KB

    MD5

    80ade1893dec9cab7f2e63538a464fcc

    SHA1

    c06614da33a65eddb506db00a124a3fc3f5be02e

    SHA256

    57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

    SHA512

    fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

  • C:\Windows\SysWOW64\TXPlatforn.exe

    Filesize

    377KB

    MD5

    80ade1893dec9cab7f2e63538a464fcc

    SHA1

    c06614da33a65eddb506db00a124a3fc3f5be02e

    SHA256

    57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

    SHA512

    fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

  • memory/3928-16-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/3928-25-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/3928-15-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/3928-13-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/3928-19-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/3944-28-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/3944-31-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/3944-43-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/3944-61-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/5116-8-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/5116-23-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/5116-7-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/5116-6-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

  • memory/5116-4-0x0000000010000000-0x00000000101B6000-memory.dmp

    Filesize

    1.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.