Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 07:33
Static task
static1
Behavioral task
behavioral1
Sample
8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe
Resource
win7-20240221-en
General
-
Target
8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe
-
Size
2.4MB
-
MD5
1e15caca642135edaa526a9731822f30
-
SHA1
bb4d87756cb4fd75cc920fa8c3d94c505a88ffa6
-
SHA256
8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481
-
SHA512
cb775fdcd3e94bec4e79007e5f2ca3e89f512f48169332231e5927d9cce1b0b53e26a06cccdf180ec7a4876b97298282d8dae6f276ab7d787c52e449eca6e4a4
-
SSDEEP
49152:9CwsbCANnKXferL7Vwe/Gg0P+WhbYF7R2L:Aws2ANnKXOaeOgmhgR2L
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3340-14-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3340-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2368-24-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2368-25-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2368-34-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3340-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3132-38-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3132-51-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3132-54-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\240645984.txt family_gh0strat behavioral2/memory/3340-14-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3340-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3340-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2368-24-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2368-25-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2368-34-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3340-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3132-38-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3132-51-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3132-54-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatfor.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatfor.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatfor.exe -
Executes dropped EXE 5 IoCs
Processes:
R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exepid process 2024 R.exe 3340 N.exe 2368 TXPlatfor.exe 3132 TXPlatfor.exe 2228 HD_8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe -
Loads dropped DLL 1 IoCs
Processes:
R.exepid process 2024 R.exe -
Processes:
resource yara_rule behavioral2/memory/3340-12-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3340-14-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3340-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3340-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2368-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2368-24-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2368-25-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2368-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3340-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3132-38-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3132-51-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3132-54-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
R.exeN.exedescription ioc process File created C:\Windows\SysWOW64\240645984.txt R.exe File created C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe N.exe -
Drops file in Program Files directory 1 IoCs
Processes:
8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 5104 2024 WerFault.exe R.exe 3464 2024 WerFault.exe R.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exepid process 772 8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe 772 8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatfor.exepid process 3132 TXPlatfor.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
N.exeTXPlatfor.exedescription pid process Token: SeIncBasePriorityPrivilege 3340 N.exe Token: SeLoadDriverPrivilege 3132 TXPlatfor.exe Token: 33 3132 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 3132 TXPlatfor.exe Token: 33 3132 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 3132 TXPlatfor.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exepid process 772 8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe 772 8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exeN.exeTXPlatfor.execmd.exedescription pid process target process PID 772 wrote to memory of 2024 772 8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe R.exe PID 772 wrote to memory of 2024 772 8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe R.exe PID 772 wrote to memory of 2024 772 8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe R.exe PID 772 wrote to memory of 3340 772 8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe N.exe PID 772 wrote to memory of 3340 772 8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe N.exe PID 772 wrote to memory of 3340 772 8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe N.exe PID 3340 wrote to memory of 1488 3340 N.exe cmd.exe PID 3340 wrote to memory of 1488 3340 N.exe cmd.exe PID 3340 wrote to memory of 1488 3340 N.exe cmd.exe PID 2368 wrote to memory of 3132 2368 TXPlatfor.exe TXPlatfor.exe PID 2368 wrote to memory of 3132 2368 TXPlatfor.exe TXPlatfor.exe PID 2368 wrote to memory of 3132 2368 TXPlatfor.exe TXPlatfor.exe PID 772 wrote to memory of 2228 772 8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe HD_8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe PID 772 wrote to memory of 2228 772 8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe HD_8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe PID 1488 wrote to memory of 2292 1488 cmd.exe PING.EXE PID 1488 wrote to memory of 2292 1488 cmd.exe PING.EXE PID 1488 wrote to memory of 2292 1488 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe"C:\Users\Admin\AppData\Local\Temp\8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 4603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 3963⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\HD_8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exeC:\Users\Admin\AppData\Local\Temp\HD_8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2024 -ip 20241⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2024 -ip 20241⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_8e478acd30f38ace1a377aba33339a20e830f40ed65b2e4d6498f98355179481.exeFilesize
15KB
MD5e90da043972903bbbc17c0266cbdcb2c
SHA150e57c7aec913c9847e07e9ca831bfa9d23760ff
SHA256f374d5c3d59bb4d0967c355c0a6a8e723072481925ea3d8b536694affed58ff7
SHA51299d65e9f8e068c29c19005155fca17b5666bfd75a576eda39724df77262c5d674989f74147d9b11c89989535e62d6b4352e45ec5235bd7750e196483c4d2d742
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
2.4MB
MD532fc7958be0c55a4e59f59423ff580fe
SHA192be6dcfaa1428120ca91e0b9a3a1e4d1e3ae3c5
SHA256221cca3d86bd76e048b250e5f8c869bf462d9d4fe665af832ad794866ad0ee01
SHA512ea842038fdd19a3e5ed93686a234847f6048300865fadb328a335f52dc5d35f2f3568b0164eda543c7616df8ac3905041091daeec09b4d38446762fa2723e3a2
-
C:\Users\Admin\AppData\Local\Temp\N.exeFilesize
377KB
MD54a36a48e58829c22381572b2040b6fe0
SHA1f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA2563de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA5125d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
-
C:\Users\Admin\AppData\Local\Temp\R.exeFilesize
941KB
MD58dc3adf1c490211971c1e2325f1424d2
SHA14eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
-
C:\Users\Admin\AppData\Local\Temp\RCXA0D1.tmpFilesize
2.4MB
MD548d44bcd79a65e37eca5cbb365ea2287
SHA14cd05672362059e0023274a37a32f59667ca762c
SHA256096d5ad8df647a1e76c79cbb1b4ff6af11c76aab1e94063eb40da3fea6093119
SHA5125b1140bbbbe72f59f87f21b40b7aeddbe101cace1c03047fbea77b7dd2c240ec99924e8de0809e7efe572af00e51cf2715754aa31d9b196ba3bca7271903b7bd
-
C:\Users\Admin\AppData\Local\Temp\X.icoFilesize
69KB
MD5e33fb6d686b1a8b171349572c5a33f67
SHA129f24fe536adf799b69b63c83efadc1bce457a54
SHA256020c8e0963f89f4b14538b7d69e83c6fec44a29bbbd52fbb6deb2be5c697f450
SHA512cf1f1d6a9efe53f84e5b4a8246b87c0b96496716605d1b00352d9aae30e664d3d2cbadebf598b4e690a9feef0b5785887a4e643cc5f68938ca744af1d3539e55
-
C:\Windows\SysWOW64\240645984.txtFilesize
899KB
MD52a1a064db626d51d8e53f0e2589191cd
SHA1464473c402a773ca2c811454d68117e01cc9dc08
SHA2561627875b535a41ce0d66d538d52d4b9cc0125a2a39f7eeec270227a0828f8337
SHA512eb45d3bec0d0aa92f70bf9e7ba47c8280c072a59571dd2ba31a209cb3404dff6bdeb09b54e74bdbdf4639347ece39b17c568b0c5c45e0a752f320a4db36c3758
-
memory/2368-25-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2368-24-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2368-21-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2368-34-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3132-54-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3132-51-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3132-38-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3340-14-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3340-32-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3340-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3340-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3340-12-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB