Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/03/2024, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe
Resource
win7-20240221-en
General
-
Target
71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe
-
Size
3.8MB
-
MD5
bf873aaa4b27c3844a3d814c8733ff3f
-
SHA1
47a7ed5e6357d5b8639a9a324c509b1bc8ad867f
-
SHA256
71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3
-
SHA512
bb3d5fc0f352728361d21ebb631363c22b6aa4a95cee4b32be6239b27b27772cda95a4714e950c3d6f290aedb10d900c866899d28d33ecabf21fd9ca8e688cf3
-
SSDEEP
49152:yCwsbCANnKXferL7Vwe/Gg0P+WhienRoBqLikrJw9Ge:Vws2ANnKXOaeOgmhRRuk92Ge
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2516-21-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2516-20-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2516-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2432-45-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2648-43-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2432-49-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2432-52-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
resource yara_rule behavioral1/files/0x0009000000016332-6.dat family_gh0strat behavioral1/memory/2516-21-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2516-20-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2648-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2516-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2432-45-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2648-43-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2432-49-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2432-52-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\259430505.txt" R.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatfor.exe -
Executes dropped EXE 6 IoCs
pid Process 2908 R.exe 2516 N.exe 2648 TXPlatfor.exe 2432 TXPlatfor.exe 2452 HD_71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 2856 Remote Data.exe -
Loads dropped DLL 8 IoCs
pid Process 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 2908 R.exe 2892 svchost.exe 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 2648 TXPlatfor.exe 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 2892 svchost.exe 2856 Remote Data.exe -
resource yara_rule behavioral1/memory/2516-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2516-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2516-20-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2648-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2516-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2432-45-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2648-43-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2432-49-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2432-52-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\259430505.txt R.exe File opened for modification C:\Windows\SysWOW64\ini.ini R.exe File created C:\Windows\SysWOW64\Remote Data.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Remote Data.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2456 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2432 TXPlatfor.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2516 N.exe Token: SeLoadDriverPrivilege 2432 TXPlatfor.exe Token: 33 2432 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 2432 TXPlatfor.exe Token: 33 2432 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 2432 TXPlatfor.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2908 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 28 PID 2508 wrote to memory of 2908 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 28 PID 2508 wrote to memory of 2908 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 28 PID 2508 wrote to memory of 2908 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 28 PID 2508 wrote to memory of 2516 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 31 PID 2508 wrote to memory of 2516 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 31 PID 2508 wrote to memory of 2516 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 31 PID 2508 wrote to memory of 2516 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 31 PID 2508 wrote to memory of 2516 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 31 PID 2508 wrote to memory of 2516 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 31 PID 2508 wrote to memory of 2516 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 31 PID 2516 wrote to memory of 2660 2516 N.exe 33 PID 2516 wrote to memory of 2660 2516 N.exe 33 PID 2516 wrote to memory of 2660 2516 N.exe 33 PID 2516 wrote to memory of 2660 2516 N.exe 33 PID 2648 wrote to memory of 2432 2648 TXPlatfor.exe 34 PID 2648 wrote to memory of 2432 2648 TXPlatfor.exe 34 PID 2648 wrote to memory of 2432 2648 TXPlatfor.exe 34 PID 2648 wrote to memory of 2432 2648 TXPlatfor.exe 34 PID 2648 wrote to memory of 2432 2648 TXPlatfor.exe 34 PID 2648 wrote to memory of 2432 2648 TXPlatfor.exe 34 PID 2648 wrote to memory of 2432 2648 TXPlatfor.exe 34 PID 2508 wrote to memory of 2452 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 36 PID 2508 wrote to memory of 2452 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 36 PID 2508 wrote to memory of 2452 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 36 PID 2508 wrote to memory of 2452 2508 71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe 36 PID 2660 wrote to memory of 2456 2660 cmd.exe 37 PID 2660 wrote to memory of 2456 2660 cmd.exe 37 PID 2660 wrote to memory of 2456 2660 cmd.exe 37 PID 2660 wrote to memory of 2456 2660 cmd.exe 37 PID 2892 wrote to memory of 2856 2892 svchost.exe 38 PID 2892 wrote to memory of 2856 2892 svchost.exe 38 PID 2892 wrote to memory of 2856 2892 svchost.exe 38 PID 2892 wrote to memory of 2856 2892 svchost.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe"C:\Users\Admin\AppData\Local\Temp\71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2908
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2456
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exeC:\Users\Admin\AppData\Local\Temp\HD_71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe2⤵
- Executes dropped EXE
PID:2452
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵PID:2884
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\259430505.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe
Filesize512KB
MD508838b500ee6950480b0e042c9c3055b
SHA1ae7003bcfa4ca0c9db9799040af0554da9d47eba
SHA256649aec81e66e3029c8843963cfe74608e089c938b1ff2e8cdefe92f7aa13f7f0
SHA512b1680890c83ef068659edad6bc3fa83c4624ab243b9b9a8cd4c9383d17c44fdb84bd50f3d7c8612fdd455dab19675d1eb9220338ed68f46fd356659325aeebb8
-
Filesize
1.9MB
MD5c0a306662875c7cfff50d0681e2a8f64
SHA100f24613d746d255a44a3a34583578e3d5653a77
SHA256da2394e7fffd4434ee463734440621e435ddb1fe82f6d234157df3f01974236c
SHA512d15352c94cdfb1645e2c5f8e538ad4660bbfb173fdd62f1818f4bf6ded712d1d9cddf83922751d383177a512462f16efc11b1160f3653d8de4f94e843bbaaed9
-
Filesize
941KB
MD58dc3adf1c490211971c1e2325f1424d2
SHA14eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
-
\Users\Admin\AppData\Local\Temp\HD_71e7a39ce3a4ef509af84372ef44d06bfc78ef6673358170d78282a82ba04ca3.exe
Filesize1.2MB
MD509038612f494ec878f4dff0b0a8a8d95
SHA1eb94b8d8ae82f0b4c4785c2c91fc4d1053813b34
SHA256e23026289a3fc99feed051e61717520ccf7bad743440c434e924a5c9b98edf11
SHA5120fbe90839837667767f823bb30f005ee42620801f8365eeeab5ab7f3bbae7fb6d130197c3f77ca23e046ec04c54517f6266c1f915ef2c191feb3410a79e6392e
-
Filesize
377KB
MD54a36a48e58829c22381572b2040b6fe0
SHA1f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA2563de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA5125d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
-
Filesize
899KB
MD511007288a4810e4185819d180bc0aa08
SHA1ea19e8e9be198df86a544842e3e11e9ed8b7dd8b
SHA256cd4b537332b2062384db28caec92d4988d3bf95e5a1b2afc1af016905c4ac350
SHA51276b245aa77cee34cd4a04c9c3fcb3d9e5533c27319a8fde03e5ca4f10109a7cc1018ba3f507811c5af54bf063f708a1816ffceb961ef7672d3a5d274d4336b55
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d