Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 13:37
Static task
static1
Behavioral task
behavioral1
Sample
db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe
Resource
win7-20240220-en
General
-
Target
db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe
-
Size
1.3MB
-
MD5
e4aaaafd0ce60dd7dd3b54522a2eb1ad
-
SHA1
f9c71c06663fdb8ade290a8bf7e8f5622196946c
-
SHA256
db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72
-
SHA512
84b4c83d528b27fff384f5e20d83a81ae67bc623a65ae1e1a1e6838d4be02acacbdb725fb7bc15216cbdc7f61b469c76c871d724ed37eab0066b8f3b9c6ec5c1
-
SSDEEP
24576:q89tv9/7JtDElDEExIecl1erdg0MCiVWhR/ewpe3dk:q89XJt4HIZ/Gg0P+WhPpe3dk
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1204-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1204-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1204-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2796-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2556-43-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2796-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2556-28-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2556-26-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2556-66-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1204-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1204-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1204-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2796-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2556-43-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2796-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2556-28-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2556-26-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2556-66-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 3 IoCs
Processes:
QQ.exeTXPlatforn.exeTXPlatforn.exepid process 1204 QQ.exe 2796 TXPlatforn.exe 2556 TXPlatforn.exe -
Loads dropped DLL 2 IoCs
Processes:
db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exeTXPlatforn.exepid process 1940 db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe 2796 TXPlatforn.exe -
Processes:
resource yara_rule behavioral1/memory/1204-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1204-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1204-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1204-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2796-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2556-43-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2796-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2556-28-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2556-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2556-66-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
QQ.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe -
Drops file in Program Files directory 4 IoCs
Processes:
db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2556 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
QQ.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 1204 QQ.exe Token: SeLoadDriverPrivilege 2556 TXPlatforn.exe Token: 33 2556 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2556 TXPlatforn.exe Token: 33 2556 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2556 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exepid process 1940 db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe 1940 db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exeTXPlatforn.exeQQ.execmd.exedescription pid process target process PID 1940 wrote to memory of 1204 1940 db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe QQ.exe PID 1940 wrote to memory of 1204 1940 db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe QQ.exe PID 1940 wrote to memory of 1204 1940 db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe QQ.exe PID 1940 wrote to memory of 1204 1940 db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe QQ.exe PID 1940 wrote to memory of 1204 1940 db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe QQ.exe PID 1940 wrote to memory of 1204 1940 db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe QQ.exe PID 1940 wrote to memory of 1204 1940 db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe QQ.exe PID 2796 wrote to memory of 2556 2796 TXPlatforn.exe TXPlatforn.exe PID 2796 wrote to memory of 2556 2796 TXPlatforn.exe TXPlatforn.exe PID 2796 wrote to memory of 2556 2796 TXPlatforn.exe TXPlatforn.exe PID 2796 wrote to memory of 2556 2796 TXPlatforn.exe TXPlatforn.exe PID 2796 wrote to memory of 2556 2796 TXPlatforn.exe TXPlatforn.exe PID 2796 wrote to memory of 2556 2796 TXPlatforn.exe TXPlatforn.exe PID 2796 wrote to memory of 2556 2796 TXPlatforn.exe TXPlatforn.exe PID 1204 wrote to memory of 2692 1204 QQ.exe cmd.exe PID 1204 wrote to memory of 2692 1204 QQ.exe cmd.exe PID 1204 wrote to memory of 2692 1204 QQ.exe cmd.exe PID 1204 wrote to memory of 2692 1204 QQ.exe cmd.exe PID 2692 wrote to memory of 2184 2692 cmd.exe PING.EXE PID 2692 wrote to memory of 2184 2692 cmd.exe PING.EXE PID 2692 wrote to memory of 2184 2692 cmd.exe PING.EXE PID 2692 wrote to memory of 2184 2692 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe"C:\Users\Admin\AppData\Local\Temp\db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\QQ.exeC:\Users\Admin\AppData\Local\Temp\\QQ.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\QQ.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2184
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.3MB
MD5e4aaaafd0ce60dd7dd3b54522a2eb1ad
SHA1f9c71c06663fdb8ade290a8bf7e8f5622196946c
SHA256db3f0f02d77342d7a3eabce90731bf1a6c9ce5cba27cdfb51e12839baa428b72
SHA51284b4c83d528b27fff384f5e20d83a81ae67bc623a65ae1e1a1e6838d4be02acacbdb725fb7bc15216cbdc7f61b469c76c871d724ed37eab0066b8f3b9c6ec5c1
-
\Users\Admin\AppData\Local\Temp\QQ.exeFilesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
-
memory/1204-9-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1204-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1204-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1204-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2556-43-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2556-28-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2556-26-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2556-66-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2796-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2796-29-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB