Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230824-en -
resource tags
arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system -
submitted
29/08/2023, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe
Resource
win7-20230824-en
General
-
Target
9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe
-
Size
1.5MB
-
MD5
0b039deb607419f5bff838578e302eae
-
SHA1
a9d2b9524b1947777fd5554ccd56825fc4cf1d30
-
SHA256
9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e
-
SHA512
910ec24860db2d6b618866a87447efd2be79dbfe3ce9dea599bd4a478b278d891c512aabcd77bf1c83461b76f553c51b1fb7e7522e4d1aef920f00e7cb245ee1
-
SSDEEP
24576:j89tv9/7JtDElDEExIecl1erdg0MCiVWhR/K:j89XJt4HIZ/Gg0P+Wh0
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2200-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2200-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2200-22-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2116-24-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1956-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1956-57-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1956-66-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
resource yara_rule behavioral1/memory/2200-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2200-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2200-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2116-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2200-22-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2116-24-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1956-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1956-57-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1956-66-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 3 IoCs
pid Process 2200 QQ.exe 2116 TXPlatforn.exe 1956 TXPlatforn.exe -
Loads dropped DLL 2 IoCs
pid Process 3044 9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe 2116 TXPlatforn.exe -
resource yara_rule behavioral1/memory/2200-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2200-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2200-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2200-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2116-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2200-22-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2116-24-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1956-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1956-57-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1956-66-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2912 PING.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1956 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2200 QQ.exe Token: SeLoadDriverPrivilege 1956 TXPlatforn.exe Token: 33 1956 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 1956 TXPlatforn.exe Token: 33 1956 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 1956 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3044 9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe 3044 9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2200 3044 9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe 28 PID 3044 wrote to memory of 2200 3044 9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe 28 PID 3044 wrote to memory of 2200 3044 9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe 28 PID 3044 wrote to memory of 2200 3044 9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe 28 PID 3044 wrote to memory of 2200 3044 9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe 28 PID 3044 wrote to memory of 2200 3044 9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe 28 PID 3044 wrote to memory of 2200 3044 9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe 28 PID 2200 wrote to memory of 2252 2200 QQ.exe 30 PID 2200 wrote to memory of 2252 2200 QQ.exe 30 PID 2200 wrote to memory of 2252 2200 QQ.exe 30 PID 2200 wrote to memory of 2252 2200 QQ.exe 30 PID 2116 wrote to memory of 1956 2116 TXPlatforn.exe 31 PID 2116 wrote to memory of 1956 2116 TXPlatforn.exe 31 PID 2116 wrote to memory of 1956 2116 TXPlatforn.exe 31 PID 2116 wrote to memory of 1956 2116 TXPlatforn.exe 31 PID 2116 wrote to memory of 1956 2116 TXPlatforn.exe 31 PID 2116 wrote to memory of 1956 2116 TXPlatforn.exe 31 PID 2116 wrote to memory of 1956 2116 TXPlatforn.exe 31 PID 2252 wrote to memory of 2912 2252 cmd.exe 33 PID 2252 wrote to memory of 2912 2252 cmd.exe 33 PID 2252 wrote to memory of 2912 2252 cmd.exe 33 PID 2252 wrote to memory of 2912 2252 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe"C:\Users\Admin\AppData\Local\Temp\9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\QQ.exeC:\Users\Admin\AppData\Local\Temp\\QQ.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\QQ.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2912
-
-
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD50b039deb607419f5bff838578e302eae
SHA1a9d2b9524b1947777fd5554ccd56825fc4cf1d30
SHA2569c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e
SHA512910ec24860db2d6b618866a87447efd2be79dbfe3ce9dea599bd4a478b278d891c512aabcd77bf1c83461b76f553c51b1fb7e7522e4d1aef920f00e7cb245ee1
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c