Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2023, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe
Resource
win7-20230712-en
General
-
Target
555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe
-
Size
4.5MB
-
MD5
1047bba83c59fa29a3063fda0ce8fbea
-
SHA1
abcb9fbf2d30490407115a106a295d0e41f255e6
-
SHA256
555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75
-
SHA512
8238a337bd1ae7bbb967d7eb7fdcda92256af44858b7abf4174ef7daa3fe9e37dacdf36a926cd36546803dd5799a57a8948579297db988538296db0f1545c08a
-
SSDEEP
49152:j89XJt4HIZ/Gg0P+WhKPLGc4yiyXB1jOBLEzNcSBoU1U/qSc:QZJt4HIZOgmhKbSc
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4216-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4216-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1368-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1368-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4216-20-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1368-24-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3684-27-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3684-30-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3684-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3684-37-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 12 IoCs
resource yara_rule behavioral2/memory/4216-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4216-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4216-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1368-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1368-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1368-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4216-20-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1368-24-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3684-27-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3684-30-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3684-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3684-37-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
pid Process 4216 QQ.exe 1368 TXPlatforn.exe 4796 HD_555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 3684 TXPlatforn.exe -
resource yara_rule behavioral2/memory/4216-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4216-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4216-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4216-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1368-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1368-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1368-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1368-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4216-20-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1368-24-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3684-27-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3684-30-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3684-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3684-37-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3788 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4124 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 4124 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 4796 HD_555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 4796 HD_555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 3684 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4216 QQ.exe Token: SeIncBasePriorityPrivilege 4796 HD_555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe Token: SeLoadDriverPrivilege 3684 TXPlatforn.exe Token: 33 3684 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 3684 TXPlatforn.exe Token: 33 3684 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 3684 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4124 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 4124 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4124 wrote to memory of 4216 4124 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 83 PID 4124 wrote to memory of 4216 4124 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 83 PID 4124 wrote to memory of 4216 4124 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 83 PID 4216 wrote to memory of 4756 4216 QQ.exe 86 PID 4216 wrote to memory of 4756 4216 QQ.exe 86 PID 4216 wrote to memory of 4756 4216 QQ.exe 86 PID 4124 wrote to memory of 4796 4124 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 85 PID 4124 wrote to memory of 4796 4124 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 85 PID 4124 wrote to memory of 4796 4124 555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe 85 PID 1368 wrote to memory of 3684 1368 TXPlatforn.exe 88 PID 1368 wrote to memory of 3684 1368 TXPlatforn.exe 88 PID 1368 wrote to memory of 3684 1368 TXPlatforn.exe 88 PID 4756 wrote to memory of 3788 4756 cmd.exe 89 PID 4756 wrote to memory of 3788 4756 cmd.exe 89 PID 4756 wrote to memory of 3788 4756 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe"C:\Users\Admin\AppData\Local\Temp\555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\QQ.exeC:\Users\Admin\AppData\Local\Temp\\QQ.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\QQ.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:3788
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exeC:\Users\Admin\AppData\Local\Temp\HD_555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:3684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_555a9238b008e883bf541291edd7833f71251935282ef7ebb0c93900f719ed75.exe
Filesize3.0MB
MD5ed1d0ab126a694188b35ed291d807e16
SHA1a9f245b54ef78333483a105615a02fa0f0efc16f
SHA25639a0b6e46df2bcf223912487c3233e8484559ebf3b93e56f3041546092ad383b
SHA5120c260baa6cb4769d42e80bcad59bd94c4f0a33bf2cbe6d651113f6a821ca98a52a03f16ceeb018b3bb2dd42579fb78984f731d80b21de0f09368e830982f8c9b
-
Filesize
1.5MB
MD50b039deb607419f5bff838578e302eae
SHA1a9d2b9524b1947777fd5554ccd56825fc4cf1d30
SHA2569c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e
SHA512910ec24860db2d6b618866a87447efd2be79dbfe3ce9dea599bd4a478b278d891c512aabcd77bf1c83461b76f553c51b1fb7e7522e4d1aef920f00e7cb245ee1
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c