Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
29/08/2023, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe
Resource
win7-20230712-en
General
-
Target
a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe
-
Size
6.1MB
-
MD5
875227db5701889e4a67f666881b251f
-
SHA1
962d9cdaf40754c0ec7e2c652f7f1ca42d43ec7b
-
SHA256
a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf
-
SHA512
6dcaec5a774df6dfd8fd6586c8bc1ba18fc89ce1a644202b15d83b10d9ad7502c9ea0adb51a1275698908e358f8255c2519a64a8b48d464f4cc20766f34fba9b
-
SSDEEP
98304:bZJt4HINy2LkeefS7peKOB3NLSiwbrM95+NTl:diINy2Lkee4pc3+rk5ql
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3044-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/3044-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/3044-21-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2852-28-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2808-27-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2808-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2808-61-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2808-74-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
resource yara_rule behavioral1/memory/3044-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/3044-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2852-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/3044-21-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2852-28-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2808-27-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2808-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2808-61-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2808-74-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
pid Process 3044 RVN.exe 2852 TXPlatforn.exe 2808 TXPlatforn.exe 2724 HD_a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe -
Loads dropped DLL 3 IoCs
pid Process 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 2852 TXPlatforn.exe 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe -
resource yara_rule behavioral1/memory/3044-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/3044-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/3044-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/3044-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2852-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/3044-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2852-28-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2808-27-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2808-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2808-61-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2808-74-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1108 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2808 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3044 RVN.exe Token: SeLoadDriverPrivilege 2808 TXPlatforn.exe Token: 33 2808 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2808 TXPlatforn.exe Token: 33 2808 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2808 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2220 wrote to memory of 3044 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 28 PID 2220 wrote to memory of 3044 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 28 PID 2220 wrote to memory of 3044 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 28 PID 2220 wrote to memory of 3044 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 28 PID 2220 wrote to memory of 3044 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 28 PID 2220 wrote to memory of 3044 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 28 PID 2220 wrote to memory of 3044 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 28 PID 3044 wrote to memory of 2856 3044 RVN.exe 30 PID 3044 wrote to memory of 2856 3044 RVN.exe 30 PID 3044 wrote to memory of 2856 3044 RVN.exe 30 PID 3044 wrote to memory of 2856 3044 RVN.exe 30 PID 2852 wrote to memory of 2808 2852 TXPlatforn.exe 31 PID 2852 wrote to memory of 2808 2852 TXPlatforn.exe 31 PID 2852 wrote to memory of 2808 2852 TXPlatforn.exe 31 PID 2852 wrote to memory of 2808 2852 TXPlatforn.exe 31 PID 2852 wrote to memory of 2808 2852 TXPlatforn.exe 31 PID 2852 wrote to memory of 2808 2852 TXPlatforn.exe 31 PID 2852 wrote to memory of 2808 2852 TXPlatforn.exe 31 PID 2220 wrote to memory of 2724 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 33 PID 2220 wrote to memory of 2724 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 33 PID 2220 wrote to memory of 2724 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 33 PID 2220 wrote to memory of 2724 2220 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 33 PID 2856 wrote to memory of 1108 2856 cmd.exe 34 PID 2856 wrote to memory of 1108 2856 cmd.exe 34 PID 2856 wrote to memory of 1108 2856 cmd.exe 34 PID 2856 wrote to memory of 1108 2856 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe"C:\Users\Admin\AppData\Local\Temp\a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:1108
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exeC:\Users\Admin\AppData\Local\Temp\HD_a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe2⤵
- Executes dropped EXE
PID:2724
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD54c4d4ae160a87b9e7503e64d50aabeed
SHA108a895bb16ac7a3e3d501c71b7456b705ed72804
SHA256fa91ea78c5df64ecd5562a6d414c95fec1ccbc42d93e158b091993835ca5e89a
SHA5127fb5bffef997e908ecff48e16b80e5409eb6aa81965a42706d948cefdb915c5a537ad2023bc5006a5a713a643cd50e5d2b8222643b413bbe40a882704697c9fd
-
C:\Users\Admin\AppData\Local\Temp\HD_a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe
Filesize5.1MB
MD55a687d92e7e5b897d940a957c58f4b93
SHA1315ec2cc6837fd8065a410dabfc5afc192c4f856
SHA256e3eb80a72e7cd76dc24afd78a890e4d51ce0cb68586156167c9aba096b3fc75f
SHA5122d526d3e6b2ca1cb327b9f151794bd7aefbf8e9fff5d1b50b022afc4fb030fda60efb2ebf487217057efc4c740266d0e5441d5fdae60ee903c7e9052d2714089
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
\Users\Admin\AppData\Local\Temp\HD_a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe
Filesize5.1MB
MD55a687d92e7e5b897d940a957c58f4b93
SHA1315ec2cc6837fd8065a410dabfc5afc192c4f856
SHA256e3eb80a72e7cd76dc24afd78a890e4d51ce0cb68586156167c9aba096b3fc75f
SHA5122d526d3e6b2ca1cb327b9f151794bd7aefbf8e9fff5d1b50b022afc4fb030fda60efb2ebf487217057efc4c740266d0e5441d5fdae60ee903c7e9052d2714089
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4