Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 15:35
Static task
static1
Behavioral task
behavioral1
Sample
960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe
Resource
win7-20240221-en
General
-
Target
960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe
-
Size
3.1MB
-
MD5
b40d359f73cd60da3f8de3aaaabf5161
-
SHA1
a1554081c9cfc69280f4a917a5fe750042b66ea8
-
SHA256
960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d
-
SHA512
29adbd2f197088f42dca610ed0583c54c6d4adf90ea871d5023aa413968277a7bfdb2ca8ba954e22296ac147ea4166addb3395146aff9e0e015ce195babfe2fd
-
SSDEEP
98304:YZJt4HINy2Lk54JDmn217hIE0N81vLl7hVE:+iINy2LkCFmnehIEJ9E
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2524-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2524-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2524-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/404-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/404-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/404-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/404-23-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2312-24-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2312-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2312-34-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2312-45-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/2524-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2524-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2524-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/404-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/404-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/404-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/404-23-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2312-24-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2312-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2312-34-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2312-45-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
Processes:
RVN.exeTXPlatforn.exeTXPlatforn.exeHD_960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exepid process 2524 RVN.exe 404 TXPlatforn.exe 2312 TXPlatforn.exe 4720 HD_960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe -
Processes:
resource yara_rule behavioral2/memory/2524-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2524-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2524-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2524-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/404-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/404-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/404-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/404-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/404-23-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2312-24-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2312-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2312-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2312-45-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
RVN.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 5 IoCs
Processes:
960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exepid process 2460 960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe 2460 960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2312 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RVN.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2524 RVN.exe Token: SeLoadDriverPrivilege 2312 TXPlatforn.exe Token: 33 2312 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2312 TXPlatforn.exe Token: 33 2312 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2312 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exepid process 2460 960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe 2460 960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exeRVN.exeTXPlatforn.execmd.exedescription pid process target process PID 2460 wrote to memory of 2524 2460 960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe RVN.exe PID 2460 wrote to memory of 2524 2460 960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe RVN.exe PID 2460 wrote to memory of 2524 2460 960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe RVN.exe PID 2524 wrote to memory of 948 2524 RVN.exe cmd.exe PID 2524 wrote to memory of 948 2524 RVN.exe cmd.exe PID 2524 wrote to memory of 948 2524 RVN.exe cmd.exe PID 404 wrote to memory of 2312 404 TXPlatforn.exe TXPlatforn.exe PID 404 wrote to memory of 2312 404 TXPlatforn.exe TXPlatforn.exe PID 404 wrote to memory of 2312 404 TXPlatforn.exe TXPlatforn.exe PID 2460 wrote to memory of 4720 2460 960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe HD_960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe PID 2460 wrote to memory of 4720 2460 960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe HD_960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe PID 2460 wrote to memory of 4720 2460 960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe HD_960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe PID 948 wrote to memory of 4608 948 cmd.exe PING.EXE PID 948 wrote to memory of 4608 948 cmd.exe PING.EXE PID 948 wrote to memory of 4608 948 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe"C:\Users\Admin\AppData\Local\Temp\960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\HD_960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exeC:\Users\Admin\AppData\Local\Temp\HD_960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exe2⤵
- Executes dropped EXE
PID:4720
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2312
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_960582f60abe1bcd8febcd2f95c4001b6f3664d47e583a67b332313d5cf1dc0d.exeFilesize
1.7MB
MD5969e3cfaf8c9210547fee5b8c424ba6b
SHA1a67b5be1bb6d2b0e00101c9f3bde73814b7fa4b1
SHA256f04c8626900622bb3ca6a38c44f66a582e4850713cf46da0bca796da7cabccda
SHA5127409b6d4dda05cfa4426f1252756af0c751dec1946bfb64d7acf100a77be3c38ea4c09e52a28121b0e117ab7692a5a05f3255d97aa17586c8ab72b121794efcb
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.4MB
MD5acbc182229c226c42ae21244889d28a0
SHA137fd5554085c458cacdfc0eb089d4f0f018fca80
SHA2568fb47fe776feea8060a3bbba57860cd1e15626ac5eae8c05e51597eb1c8ab1d3
SHA512178b27d3778b3dfee5117bce4965c23d3e1fac7c549add51f78c5b6ce5413c1dd998d4f26422f81792a48b7a1d05dedcb36a10d6ca83ff2f897a4feefb645b26
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeFilesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
memory/404-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/404-23-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/404-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/404-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/404-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2312-31-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2312-24-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2312-34-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2312-45-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2524-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2524-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2524-10-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2524-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB