Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 16:40
Static task
static1
Behavioral task
behavioral1
Sample
d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe
Resource
win7-20240221-en
General
-
Target
d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe
-
Size
1.4MB
-
MD5
4f6dd03dd53edcd806066e2f2b6e5c45
-
SHA1
41393a2aff175ee9e7944ecd1d878b2e326b1e99
-
SHA256
d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4
-
SHA512
793aa745e7c6d23d060ec0e3c1750af51c6d01b13ca76becde40d84a6a9fdd2001911706fde82256f561e871d40661b2f7098d1f328eee54d202f3140637ce67
-
SSDEEP
24576:O09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+YNQ4R7yn2ruv+Z:O09XJt4HIN2H2tFvduySmNrR7yn2ruvc
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/5044-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/5044-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/5044-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3112-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3112-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3112-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4816-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3112-24-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4816-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4816-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4816-37-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/5044-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/5044-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/5044-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3112-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3112-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3112-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4816-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3112-24-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4816-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4816-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4816-37-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
Processes:
RVN.exeTXPlatforn.exeTXPlatforn.exeHD_d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exepid process 5044 RVN.exe 3112 TXPlatforn.exe 4816 TXPlatforn.exe 1432 HD_d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe -
Processes:
resource yara_rule behavioral2/memory/5044-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5044-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5044-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5044-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3112-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3112-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3112-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3112-14-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4816-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3112-24-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4816-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4816-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4816-37-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
RVN.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 5 IoCs
Processes:
d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3336 1432 WerFault.exe HD_d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exepid process 2132 d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe 2132 d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 4816 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RVN.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 5044 RVN.exe Token: SeLoadDriverPrivilege 4816 TXPlatforn.exe Token: 33 4816 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4816 TXPlatforn.exe Token: 33 4816 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4816 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exepid process 2132 d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe 2132 d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exeRVN.exeTXPlatforn.execmd.exedescription pid process target process PID 2132 wrote to memory of 5044 2132 d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe RVN.exe PID 2132 wrote to memory of 5044 2132 d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe RVN.exe PID 2132 wrote to memory of 5044 2132 d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe RVN.exe PID 5044 wrote to memory of 2984 5044 RVN.exe cmd.exe PID 5044 wrote to memory of 2984 5044 RVN.exe cmd.exe PID 5044 wrote to memory of 2984 5044 RVN.exe cmd.exe PID 2132 wrote to memory of 1432 2132 d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe HD_d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe PID 2132 wrote to memory of 1432 2132 d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe HD_d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe PID 2132 wrote to memory of 1432 2132 d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe HD_d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe PID 3112 wrote to memory of 4816 3112 TXPlatforn.exe TXPlatforn.exe PID 3112 wrote to memory of 4816 3112 TXPlatforn.exe TXPlatforn.exe PID 3112 wrote to memory of 4816 3112 TXPlatforn.exe TXPlatforn.exe PID 2984 wrote to memory of 3240 2984 cmd.exe PING.EXE PID 2984 wrote to memory of 3240 2984 cmd.exe PING.EXE PID 2984 wrote to memory of 3240 2984 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe"C:\Users\Admin\AppData\Local\Temp\d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\HD_d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exeC:\Users\Admin\AppData\Local\Temp\HD_d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 8043⤵
- Program crash
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1432 -ip 14321⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.3MB
MD522a2c1f28e513bee9e3adc2d9bc1a808
SHA19d6d3ad153e801b712a944f5dbb7be4a0aa2ed75
SHA25664c4aeb7fa27f2b60db8972a150b483f8e04c59f960a464d18f97cbb0c2ad2e0
SHA512b3ee03d9f80135562f827cbf83944032c438a88eb2afe81a3bcd8db28cf2b32ff79a517eed38adeda955d9b55109edb050ff85209f4b1a9eea8fb78efa128f79
-
C:\Users\Admin\AppData\Local\Temp\HD_d75fffcf3594a4dce06c859860b99c1fa1939bd9847bcfe029b36ced7a437fd4.exeFilesize
57KB
MD5bb6abff7a381091bd0f291c66888b473
SHA1fa8c3a88a5f4a8be49d95aa5017ca69dd11bb4d6
SHA256e11f7958cb26b99b972fd8252ab5f2c42075dff5eee92348012bbe1131ac7537
SHA5123b5fd81a27cf8cb74490335f6012cf7c24a5ac2fb57052dfcc4f60c005e0b87e7b1bf0298494befdf692f6e5daf888014b0248ed1d7a03836c305840fe2f0bd8
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeFilesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
memory/1432-31-0x00000000745CE000-0x00000000745CF000-memory.dmpFilesize
4KB
-
memory/1432-30-0x0000000000DE0000-0x0000000000DEE000-memory.dmpFilesize
56KB
-
memory/3112-14-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3112-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3112-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3112-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3112-24-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4816-29-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4816-32-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4816-36-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4816-37-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5044-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5044-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5044-10-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5044-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB