Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 16:36
Static task
static1
Behavioral task
behavioral1
Sample
8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe
Resource
win7-20240221-en
General
-
Target
8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe
-
Size
3.6MB
-
MD5
6c017a7c25ced7d96b5bb59adc65aaec
-
SHA1
be3b20c1a16d9b5e16a37536fdaa701ef1b42ce6
-
SHA256
8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27
-
SHA512
800bf235c35261aa898e25aad7e597f6981eee1729251da819d48982949da730e0f6626122b0423b5ca617b3d6acfba9276329050de9fd9c81f5320582d17f37
-
SSDEEP
49152:jQZAdVyVT9n/Gg0P+WhoXiNrXXZXDrdBaAdvUk6I9Hd7bs8BA5KYh7hn+7FP0qfs:EGdVyVT9nOgmhFNrXXZvvGhNnicwMge
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2520-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2520-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2676-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2520-25-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2340-34-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2676-33-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2340-38-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2340-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2340-39-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/2520-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2520-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2676-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2520-25-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2340-34-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2676-33-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2340-38-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2340-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2340-39-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat \Windows\SysWOW64\259405669.txt family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259405669.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
Processes:
svchost.exeTXPlatforn.exeTXPlatforn.exesvchos.exeHD_8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2520 svchost.exe 2676 TXPlatforn.exe 2340 TXPlatforn.exe 2452 svchos.exe 2256 HD_8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe 1968 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 8 IoCs
Processes:
8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exeTXPlatforn.exesvchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe 2676 TXPlatforn.exe 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe 2452 svchos.exe 2744 svchost.exe 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe 2744 svchost.exe 1968 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral1/memory/2520-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2520-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2520-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2676-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2520-25-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2340-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2676-33-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2340-38-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2340-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2340-39-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchos.exesvchost.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\259405669.txt svchos.exe -
Drops file in Program Files directory 4 IoCs
Processes:
8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exepid process 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2340 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2520 svchost.exe Token: SeLoadDriverPrivilege 2340 TXPlatforn.exe Token: 33 2340 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2340 TXPlatforn.exe Token: 33 2340 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2340 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exepid process 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exeTXPlatforn.exesvchost.execmd.exesvchost.exedescription pid process target process PID 2664 wrote to memory of 2520 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe svchost.exe PID 2664 wrote to memory of 2520 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe svchost.exe PID 2664 wrote to memory of 2520 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe svchost.exe PID 2664 wrote to memory of 2520 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe svchost.exe PID 2664 wrote to memory of 2520 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe svchost.exe PID 2664 wrote to memory of 2520 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe svchost.exe PID 2664 wrote to memory of 2520 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe svchost.exe PID 2676 wrote to memory of 2340 2676 TXPlatforn.exe TXPlatforn.exe PID 2676 wrote to memory of 2340 2676 TXPlatforn.exe TXPlatforn.exe PID 2676 wrote to memory of 2340 2676 TXPlatforn.exe TXPlatforn.exe PID 2676 wrote to memory of 2340 2676 TXPlatforn.exe TXPlatforn.exe PID 2676 wrote to memory of 2340 2676 TXPlatforn.exe TXPlatforn.exe PID 2676 wrote to memory of 2340 2676 TXPlatforn.exe TXPlatforn.exe PID 2676 wrote to memory of 2340 2676 TXPlatforn.exe TXPlatforn.exe PID 2520 wrote to memory of 2492 2520 svchost.exe cmd.exe PID 2520 wrote to memory of 2492 2520 svchost.exe cmd.exe PID 2520 wrote to memory of 2492 2520 svchost.exe cmd.exe PID 2520 wrote to memory of 2492 2520 svchost.exe cmd.exe PID 2664 wrote to memory of 2452 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe svchos.exe PID 2664 wrote to memory of 2452 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe svchos.exe PID 2664 wrote to memory of 2452 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe svchos.exe PID 2664 wrote to memory of 2452 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe svchos.exe PID 2492 wrote to memory of 2336 2492 cmd.exe PING.EXE PID 2492 wrote to memory of 2336 2492 cmd.exe PING.EXE PID 2492 wrote to memory of 2336 2492 cmd.exe PING.EXE PID 2492 wrote to memory of 2336 2492 cmd.exe PING.EXE PID 2664 wrote to memory of 2256 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe HD_8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe PID 2664 wrote to memory of 2256 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe HD_8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe PID 2664 wrote to memory of 2256 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe HD_8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe PID 2664 wrote to memory of 2256 2664 8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe HD_8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe PID 2744 wrote to memory of 1968 2744 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2744 wrote to memory of 1968 2744 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2744 wrote to memory of 1968 2744 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2744 wrote to memory of 1968 2744 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe"C:\Users\Admin\AppData\Local\Temp\8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exeC:\Users\Admin\AppData\Local\Temp\HD_8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259405669.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.3MB
MD55a88b69dc04401ec052caabc9f7c468e
SHA1c0ffeb357417b8d379e4b1ef95a73ec8417307b6
SHA256909dc2a37adfb6d51c72c98df13496a82d4aa233c786f837b80709a4a65ab65c
SHA5127149324ef5240cb28344163de58813f2656b8a34651054604e735d6126df886e02e5af23dded674fbeae3ba74b4839535f79d24f3bd87e70dc7340bd11e4ea81
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
\Users\Admin\AppData\Local\Temp\HD_8863c9e88e409139c621710e3dbdb7989874f11bf582a31cbd03d55a8318ed27.exeFilesize
2.3MB
MD5dcf18d969fe50dd15be16088c9d30d02
SHA1f45b2bdff3741b895189897e1e9dd49fce10bd3a
SHA2560d14b157818d5e52fb2e6c5ed3651cf37434d1a3f8dbee3d9c6d01d69d140155
SHA5121674adfdcf4ca8cc3905e26b43a002b94882dfc886ce86d2904c32e35bf143680963883033e90d18031344b92f6d744f7f5d49cfd27b599974809f881a5c13b0
-
\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
\Windows\SysWOW64\259405669.txtFilesize
50KB
MD5e71c8aa81360f7fbf4acbcee12a7a967
SHA1e1e5a5836b6d026f3b1208af7ee7e764b9c04b9d
SHA256e2b38a4ef1b08afca57a4c398255506c8cdff336db56abcc17287aeb901a33c8
SHA512689f0acf70f8aeefc181d69d2ee6f8a570adb01adba3d334d7bb68e18a1f094cf722699724f39ae5b6ba3bf0a516a90085889e79d8deb9f989e619587c9f5a86
-
\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
memory/2340-38-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2340-34-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2340-32-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2340-39-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2520-25-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2520-9-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2520-5-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2520-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2676-33-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2676-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB