Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 16:36
Static task
static1
Behavioral task
behavioral1
Sample
7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe
Resource
win7-20240220-en
General
-
Target
7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe
-
Size
5.3MB
-
MD5
7889953fcbbc74f9469098960208f6ee
-
SHA1
2a87bd5e9abec1adce0eced20c63cdf3928c8bd6
-
SHA256
7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced
-
SHA512
7604bc161cc87a44458b924a8c94314404a0f49bf0af4654c754527c122189c2fd51568d3fefbf0c545b3d0e746d13905fcee08503ab27f051f59d61f6942e3e
-
SSDEEP
98304:9GdVyVT9nOgmhFTiUhJyn2lODDAIPCTEcCLYSqe3Q4gWrlwg:aWT9nO7TTVJynTDFz3QRxg
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1800-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1800-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1800-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2544-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2548-34-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2548-37-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2548-78-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1800-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1800-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1800-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2544-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat \Windows\SysWOW64\259392284.txt family_gh0strat behavioral1/memory/2548-34-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2548-37-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2548-78-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 5 IoCs
Processes:
svchost.exeTXPlatforn.exesvchos.exeTXPlatforn.exeHD_7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exepid process 1800 svchost.exe 2544 TXPlatforn.exe 2752 svchos.exe 2548 TXPlatforn.exe 2588 HD_7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe -
Loads dropped DLL 5 IoCs
Processes:
7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exeTXPlatforn.exesvchos.exepid process 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe 2544 TXPlatforn.exe 2752 svchos.exe 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe -
Processes:
resource yara_rule behavioral1/memory/1800-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1800-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1800-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1800-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2544-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2548-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2548-37-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2548-78-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
svchost.exesvchos.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\259392284.txt svchos.exe -
Drops file in Program Files directory 4 IoCs
Processes:
7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exepid process 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2548 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 1800 svchost.exe Token: SeLoadDriverPrivilege 2548 TXPlatforn.exe Token: 33 2548 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2548 TXPlatforn.exe Token: 33 2548 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2548 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exepid process 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exesvchost.exeTXPlatforn.execmd.exedescription pid process target process PID 1976 wrote to memory of 1800 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe svchost.exe PID 1976 wrote to memory of 1800 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe svchost.exe PID 1976 wrote to memory of 1800 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe svchost.exe PID 1976 wrote to memory of 1800 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe svchost.exe PID 1976 wrote to memory of 1800 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe svchost.exe PID 1976 wrote to memory of 1800 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe svchost.exe PID 1976 wrote to memory of 1800 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe svchost.exe PID 1800 wrote to memory of 2680 1800 svchost.exe cmd.exe PID 1800 wrote to memory of 2680 1800 svchost.exe cmd.exe PID 1800 wrote to memory of 2680 1800 svchost.exe cmd.exe PID 1800 wrote to memory of 2680 1800 svchost.exe cmd.exe PID 1976 wrote to memory of 2752 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe svchos.exe PID 1976 wrote to memory of 2752 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe svchos.exe PID 1976 wrote to memory of 2752 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe svchos.exe PID 1976 wrote to memory of 2752 1976 7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe svchos.exe PID 2544 wrote to memory of 2548 2544 TXPlatforn.exe TXPlatforn.exe PID 2544 wrote to memory of 2548 2544 TXPlatforn.exe TXPlatforn.exe PID 2544 wrote to memory of 2548 2544 TXPlatforn.exe TXPlatforn.exe PID 2544 wrote to memory of 2548 2544 TXPlatforn.exe TXPlatforn.exe PID 2544 wrote to memory of 2548 2544 TXPlatforn.exe TXPlatforn.exe PID 2544 wrote to memory of 2548 2544 TXPlatforn.exe TXPlatforn.exe PID 2544 wrote to memory of 2548 2544 TXPlatforn.exe TXPlatforn.exe PID 2680 wrote to memory of 2492 2680 cmd.exe PING.EXE PID 2680 wrote to memory of 2492 2680 cmd.exe PING.EXE PID 2680 wrote to memory of 2492 2680 cmd.exe PING.EXE PID 2680 wrote to memory of 2492 2680 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe"C:\Users\Admin\AppData\Local\Temp\7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\HD_7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exeC:\Users\Admin\AppData\Local\Temp\HD_7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exe2⤵
- Executes dropped EXE
PID:2588
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.5MB
MD5706a5c3b86f629f97d2cae9789acb9a2
SHA189c643add72dd6b6c17c9d0f7f0067f620e3f7db
SHA256a1dbf6d4e59eb71301572e2e70f7e5a0e904cf7511e8d95e73c7e95864e42eae
SHA512bdbad999ae10641efef2036ff3384f7258d628ab239f64904645c8fe8a576c0aaf4eed42c930ea6afeca03cb7fb49e436d73707a61424dd5cc96756c6a59f4d8
-
\Users\Admin\AppData\Local\Temp\HD_7be9c8698148691fda31ccb378bcd7581c9cff794091efe172ffb734e7aeeced.exeFilesize
3.8MB
MD50926684c742068edb6f9d06239285210
SHA19445b4355f6a2b0467b88341ffa184443ebcbf2b
SHA256511f9a6f14c1bf591d67fd9b14d515417b04cba7dc475bc4f5695be5bd147c43
SHA512a6b24a1b50a9b7baf9856222b92d8bf08dbc2cae16a86705c45a6db44e6cd8af33d85278da4929ee257f244c0194953b9a892ce35fed87686bfc59b1339d4e37
-
\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
\Windows\SysWOW64\259392284.txtFilesize
50KB
MD5d53de4df6bc7eead176c58f3d74a7c16
SHA15d5192c20ea8c579d23f02f3fb93e0a8c6dc1d2f
SHA2563d613e6f1d43ec66af8fc7402d5961e8ca71e11aa5f24694e8c7b4d59c099ce2
SHA512b5bd9edb64296c79a5da1e41c5dbf330cd25e774fd1a5f62f2ef63390ea598cea188f8a9d5e93465476c0b1940e1ee361fbadad81c74e30ab614a8b2bd7c8a3a
-
memory/1800-5-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1800-9-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1800-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1800-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2544-31-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2548-37-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2548-34-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2548-78-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB