Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
29/08/2023, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe
Resource
win7-20230712-en
General
-
Target
555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe
-
Size
4.5MB
-
MD5
1047bba83c59fa29a3063fda0ce8fbea
-
SHA1
abcb9fbf2d30490407115a106a295d0e41f255e6
-
SHA256
555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75
-
SHA512
8238a337bd1ae7bbb967d7eb7fdcda92256af44858b7abf4174ef7daa3fe9e37dacdf36a926cd36546803dd5799a57a8948579297db988538296db0f1545c08a
-
SSDEEP
49152:j89XJt4HIZ/Gg0P+WhKPLGc4yiyXB1jOBLEzNcSBoU1U/qSc:QZJt4HIZOgmhKbSc
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2232-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2232-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2232-21-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2608-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2952-34-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2952-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2952-39-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 8 IoCs
resource yara_rule behavioral1/memory/2232-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2232-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2608-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2232-21-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2608-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2952-34-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2952-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2952-39-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
pid Process 2232 QQ.exe 2608 TXPlatforn.exe 2952 TXPlatforn.exe 2660 HD_555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe -
Loads dropped DLL 3 IoCs
pid Process 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 2608 TXPlatforn.exe 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe -
resource yara_rule behavioral1/memory/2232-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2232-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2232-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2232-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2608-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2232-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2608-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2952-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2952-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2952-39-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2744 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 2660 HD_555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2952 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2232 QQ.exe Token: SeIncBasePriorityPrivilege 2660 HD_555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe Token: SeLoadDriverPrivilege 2952 TXPlatforn.exe Token: 33 2952 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2952 TXPlatforn.exe Token: 33 2952 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2952 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2232 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 28 PID 2376 wrote to memory of 2232 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 28 PID 2376 wrote to memory of 2232 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 28 PID 2376 wrote to memory of 2232 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 28 PID 2376 wrote to memory of 2232 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 28 PID 2376 wrote to memory of 2232 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 28 PID 2376 wrote to memory of 2232 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 28 PID 2232 wrote to memory of 2824 2232 QQ.exe 30 PID 2232 wrote to memory of 2824 2232 QQ.exe 30 PID 2232 wrote to memory of 2824 2232 QQ.exe 30 PID 2232 wrote to memory of 2824 2232 QQ.exe 30 PID 2608 wrote to memory of 2952 2608 TXPlatforn.exe 31 PID 2608 wrote to memory of 2952 2608 TXPlatforn.exe 31 PID 2608 wrote to memory of 2952 2608 TXPlatforn.exe 31 PID 2608 wrote to memory of 2952 2608 TXPlatforn.exe 31 PID 2608 wrote to memory of 2952 2608 TXPlatforn.exe 31 PID 2608 wrote to memory of 2952 2608 TXPlatforn.exe 31 PID 2608 wrote to memory of 2952 2608 TXPlatforn.exe 31 PID 2376 wrote to memory of 2660 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 32 PID 2376 wrote to memory of 2660 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 32 PID 2376 wrote to memory of 2660 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 32 PID 2376 wrote to memory of 2660 2376 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 32 PID 2824 wrote to memory of 2744 2824 cmd.exe 34 PID 2824 wrote to memory of 2744 2824 cmd.exe 34 PID 2824 wrote to memory of 2744 2824 cmd.exe 34 PID 2824 wrote to memory of 2744 2824 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe"C:\Users\Admin\AppData\Local\Temp\555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\QQ.exeC:\Users\Admin\AppData\Local\Temp\\QQ.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\QQ.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2744
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exeC:\Users\Admin\AppData\Local\Temp\HD_555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe
Filesize3.0MB
MD5ed1d0ab126a694188b35ed291d807e16
SHA1a9f245b54ef78333483a105615a02fa0f0efc16f
SHA25639a0b6e46df2bcf223912487c3233e8484559ebf3b93e56f3041546092ad383b
SHA5120c260baa6cb4769d42e80bcad59bd94c4f0a33bf2cbe6d651113f6a821ca98a52a03f16ceeb018b3bb2dd42579fb78984f731d80b21de0f09368e830982f8c9b
-
Filesize
1.5MB
MD50b039deb607419f5bff838578e302eae
SHA1a9d2b9524b1947777fd5554ccd56825fc4cf1d30
SHA2569c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e
SHA512910ec24860db2d6b618866a87447efd2be79dbfe3ce9dea599bd4a478b278d891c512aabcd77bf1c83461b76f553c51b1fb7e7522e4d1aef920f00e7cb245ee1
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
\Users\Admin\AppData\Local\Temp\HD_555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe
Filesize3.0MB
MD5ed1d0ab126a694188b35ed291d807e16
SHA1a9f245b54ef78333483a105615a02fa0f0efc16f
SHA25639a0b6e46df2bcf223912487c3233e8484559ebf3b93e56f3041546092ad383b
SHA5120c260baa6cb4769d42e80bcad59bd94c4f0a33bf2cbe6d651113f6a821ca98a52a03f16ceeb018b3bb2dd42579fb78984f731d80b21de0f09368e830982f8c9b
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c