Analysis
-
max time kernel
152s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 13:37
Static task
static1
Behavioral task
behavioral1
Sample
33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe
Resource
win7-20240508-en
General
-
Target
33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe
-
Size
4.7MB
-
MD5
e153c0ba5198e4b7279608346bcadae8
-
SHA1
cdc3544034d76455ae9a557fe37d8be031354eb0
-
SHA256
33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f
-
SHA512
fb5f3ecfff00960257f520968525aeb880bdae92df86eb2ef2134706d2beba3964eaeab24bc6eb91d7600f368d3bf5f7a175bd0c6e49105989af05394ba89d80
-
SSDEEP
49152:V89XJt4HIZ/Gg0P+Whmd5bXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8R:SZJt4HIZOgmhmd5bXsPN5kiQaZ56
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3292-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3292-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3292-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1676-21-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1676-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1676-20-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4984-27-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4984-28-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4984-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1676-34-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4984-35-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/3292-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3292-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3292-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1676-21-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1676-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1676-20-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4984-27-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4984-28-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4984-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1676-34-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4984-35-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
Processes:
QQ.exeTXPlatforn.exeHD_33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exeTXPlatforn.exepid process 3292 QQ.exe 1676 TXPlatforn.exe 3880 HD_33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe 4984 TXPlatforn.exe -
Processes:
resource yara_rule behavioral2/memory/3292-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3292-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3292-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3292-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1676-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1676-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1676-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1676-20-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4984-27-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4984-28-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4984-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1676-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4984-35-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
QQ.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe -
Drops file in Program Files directory 5 IoCs
Processes:
33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exedescription ioc process File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exepid process 4336 33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe 4336 33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 4984 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
QQ.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 3292 QQ.exe Token: SeLoadDriverPrivilege 4984 TXPlatforn.exe Token: 33 4984 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4984 TXPlatforn.exe Token: 33 4984 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4984 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exepid process 4336 33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe 4336 33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exeQQ.exeTXPlatforn.execmd.exedescription pid process target process PID 4336 wrote to memory of 3292 4336 33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe QQ.exe PID 4336 wrote to memory of 3292 4336 33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe QQ.exe PID 4336 wrote to memory of 3292 4336 33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe QQ.exe PID 4336 wrote to memory of 3880 4336 33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe HD_33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe PID 4336 wrote to memory of 3880 4336 33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe HD_33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe PID 4336 wrote to memory of 3880 4336 33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe HD_33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe PID 3292 wrote to memory of 2240 3292 QQ.exe cmd.exe PID 3292 wrote to memory of 2240 3292 QQ.exe cmd.exe PID 3292 wrote to memory of 2240 3292 QQ.exe cmd.exe PID 1676 wrote to memory of 4984 1676 TXPlatforn.exe TXPlatforn.exe PID 1676 wrote to memory of 4984 1676 TXPlatforn.exe TXPlatforn.exe PID 1676 wrote to memory of 4984 1676 TXPlatforn.exe TXPlatforn.exe PID 2240 wrote to memory of 4184 2240 cmd.exe PING.EXE PID 2240 wrote to memory of 4184 2240 cmd.exe PING.EXE PID 2240 wrote to memory of 4184 2240 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe"C:\Users\Admin\AppData\Local\Temp\33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\QQ.exeC:\Users\Admin\AppData\Local\Temp\\QQ.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\QQ.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\HD_33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exeC:\Users\Admin\AppData\Local\Temp\HD_33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exe2⤵
- Executes dropped EXE
PID:3880
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:3388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_33c30a0f35039f97c380ea2011320be3cbd648501772bd19a404e24c3afdc35f.exeFilesize
3.1MB
MD5fb083acd60fe5c3156dc25442be815e3
SHA161df59b8f3ebd8b3d29ca3aedc4995e23cacf6d8
SHA256f130b3789962d5c8b59aa250d6f26ad5945928f3905b32bf65aa7bd30348a794
SHA5127147337d2c1006bb15cfa967c9eea6826b63c8d343f866e7454d7368d25019f39e52cf179500810834244c3ca9644d6c0df0b2c3128a9051e9ee6b428fa926f6
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.6MB
MD5931858a025de988d2aeaf33e15129261
SHA1e5d739c5f59625f2625ebd77e129fa677c991238
SHA256316b3b78846cded479e1b3f94b645f1d11d5a5509f29558cb81aaf30e7e9cc52
SHA512920a8a7700e6df9217c96d617672c0fe54f945da00346063e5b9f7cc3947473675d91d016119de6d458df32f87248c7881e38d6eec554f115ed5d213c559e839
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.3MB
MD5fcdf7172ba2a86954acbc4b0811ec381
SHA1f2dd05c45077caf0ed5c1ba10aa1af0c268d6f68
SHA256dc9689d9ad11769a4e027a7f5c7c6469171af7fd87e8120d7ddb1d18b214e04e
SHA512c1500e60065f5658a056137a4306c72e34dcfab9065a3fbcb1f7f3195ad47b859909eef2d49ea151841a4bb0a4044786e59de4e01596c9beced7049c9de39535
-
C:\Users\Admin\AppData\Local\Temp\QQ.exeFilesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
C:\Users\Admin\AppData\Local\Temp\X.icoFilesize
69KB
MD5e33fb6d686b1a8b171349572c5a33f67
SHA129f24fe536adf799b69b63c83efadc1bce457a54
SHA256020c8e0963f89f4b14538b7d69e83c6fec44a29bbbd52fbb6deb2be5c697f450
SHA512cf1f1d6a9efe53f84e5b4a8246b87c0b96496716605d1b00352d9aae30e664d3d2cbadebf598b4e690a9feef0b5785887a4e643cc5f68938ca744af1d3539e55
-
memory/1676-34-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1676-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1676-21-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1676-19-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1676-20-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3292-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3292-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3292-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3292-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4984-28-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4984-31-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4984-27-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4984-35-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB