Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2023, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe
Resource
win7-20230712-en
General
-
Target
a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe
-
Size
6.1MB
-
MD5
875227db5701889e4a67f666881b251f
-
SHA1
962d9cdaf40754c0ec7e2c652f7f1ca42d43ec7b
-
SHA256
a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf
-
SHA512
6dcaec5a774df6dfd8fd6586c8bc1ba18fc89ce1a644202b15d83b10d9ad7502c9ea0adb51a1275698908e358f8255c2519a64a8b48d464f4cc20766f34fba9b
-
SSDEEP
98304:bZJt4HINy2LkeefS7peKOB3NLSiwbrM95+NTl:diINy2Lkee4pc3+rk5ql
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3904-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3904-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3904-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3028-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3028-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3904-25-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3028-26-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4200-72-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4200-75-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4200-77-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 10 IoCs
resource yara_rule behavioral2/memory/3904-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3904-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3904-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3028-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3028-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3904-25-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3028-26-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4200-72-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4200-75-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4200-77-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
pid Process 3904 RVN.exe 3028 TXPlatforn.exe 2308 HD_a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 4200 TXPlatforn.exe -
resource yara_rule behavioral2/memory/3904-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3904-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3904-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3904-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3028-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3028-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3028-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3904-25-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3028-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4200-72-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4200-75-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4200-77-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4232 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1900 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 1900 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4200 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3904 RVN.exe Token: SeLoadDriverPrivilege 4200 TXPlatforn.exe Token: 33 4200 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4200 TXPlatforn.exe Token: 33 4200 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4200 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1900 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 1900 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1900 wrote to memory of 3904 1900 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 82 PID 1900 wrote to memory of 3904 1900 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 82 PID 1900 wrote to memory of 3904 1900 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 82 PID 1900 wrote to memory of 2308 1900 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 84 PID 1900 wrote to memory of 2308 1900 a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe 84 PID 3904 wrote to memory of 4304 3904 RVN.exe 85 PID 3904 wrote to memory of 4304 3904 RVN.exe 85 PID 3904 wrote to memory of 4304 3904 RVN.exe 85 PID 3028 wrote to memory of 4200 3028 TXPlatforn.exe 86 PID 3028 wrote to memory of 4200 3028 TXPlatforn.exe 86 PID 3028 wrote to memory of 4200 3028 TXPlatforn.exe 86 PID 4304 wrote to memory of 4232 4304 cmd.exe 88 PID 4304 wrote to memory of 4232 4304 cmd.exe 88 PID 4304 wrote to memory of 4232 4304 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe"C:\Users\Admin\AppData\Local\Temp\a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:4232
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exeC:\Users\Admin\AppData\Local\Temp\HD_a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe2⤵
- Executes dropped EXE
PID:2308
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD54c4d4ae160a87b9e7503e64d50aabeed
SHA108a895bb16ac7a3e3d501c71b7456b705ed72804
SHA256fa91ea78c5df64ecd5562a6d414c95fec1ccbc42d93e158b091993835ca5e89a
SHA5127fb5bffef997e908ecff48e16b80e5409eb6aa81965a42706d948cefdb915c5a537ad2023bc5006a5a713a643cd50e5d2b8222643b413bbe40a882704697c9fd
-
C:\Users\Admin\AppData\Local\Temp\HD_a3caf369d1667da3cf24cd843d44791666f23da5f7578402ac922c7e2de095bf.exe
Filesize5.1MB
MD55a687d92e7e5b897d940a957c58f4b93
SHA1315ec2cc6837fd8065a410dabfc5afc192c4f856
SHA256e3eb80a72e7cd76dc24afd78a890e4d51ce0cb68586156167c9aba096b3fc75f
SHA5122d526d3e6b2ca1cb327b9f151794bd7aefbf8e9fff5d1b50b022afc4fb030fda60efb2ebf487217057efc4c740266d0e5441d5fdae60ee903c7e9052d2714089
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4