Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 17:36
Static task
static1
Behavioral task
behavioral1
Sample
ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe
Resource
win7-20240221-en
General
-
Target
ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe
-
Size
3.4MB
-
MD5
a0b4497318d14e9b7f6da7ed0c08eef8
-
SHA1
3de2eb02847e2dcdd6d1e108bfa3059795079570
-
SHA256
ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf
-
SHA512
922482a2ace700577daf4a02db7ed9981e3db9f87ab3a086a35c03737c15a28c4f643596694d39dcc6ccb3db730c5e7a88d815f7e49e022b35a747a70504a667
-
SSDEEP
98304:dZJt4HINy2Lk2YYYYYYYYYYYRYYYYYYYYYYL4ldYWYEu:PiINy2Lk/4Q
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2600-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2600-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2600-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2668-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2660-25-0x0000000002D40000-0x0000000002F72000-memory.dmp purplefox_rootkit behavioral1/memory/2668-38-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2572-51-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2572-58-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2572-72-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2600-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2600-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2600-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2668-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2660-25-0x0000000002D40000-0x0000000002F72000-memory.dmp family_gh0strat behavioral1/memory/2668-38-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2572-51-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2572-58-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2572-72-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
Processes:
RVN.exeTXPlatforn.exeHD_ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exeTXPlatforn.exepid process 2600 RVN.exe 2668 TXPlatforn.exe 2620 HD_ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe 2572 TXPlatforn.exe -
Loads dropped DLL 3 IoCs
Processes:
ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exeTXPlatforn.exepid process 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe 2668 TXPlatforn.exe -
Processes:
resource yara_rule behavioral1/memory/2600-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2600-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2600-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2600-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2668-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2660-25-0x0000000002D40000-0x0000000002F72000-memory.dmp upx behavioral1/memory/2668-38-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2572-51-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2572-58-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2572-72-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
RVN.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 4 IoCs
Processes:
ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exepid process 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2572 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RVN.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2600 RVN.exe Token: SeLoadDriverPrivilege 2572 TXPlatforn.exe Token: 33 2572 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2572 TXPlatforn.exe Token: 33 2572 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2572 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exepid process 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exeRVN.exeTXPlatforn.execmd.exedescription pid process target process PID 2660 wrote to memory of 2600 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe RVN.exe PID 2660 wrote to memory of 2600 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe RVN.exe PID 2660 wrote to memory of 2600 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe RVN.exe PID 2660 wrote to memory of 2600 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe RVN.exe PID 2660 wrote to memory of 2600 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe RVN.exe PID 2660 wrote to memory of 2600 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe RVN.exe PID 2660 wrote to memory of 2600 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe RVN.exe PID 2600 wrote to memory of 2552 2600 RVN.exe cmd.exe PID 2600 wrote to memory of 2552 2600 RVN.exe cmd.exe PID 2600 wrote to memory of 2552 2600 RVN.exe cmd.exe PID 2600 wrote to memory of 2552 2600 RVN.exe cmd.exe PID 2660 wrote to memory of 2620 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe HD_ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe PID 2660 wrote to memory of 2620 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe HD_ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe PID 2660 wrote to memory of 2620 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe HD_ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe PID 2660 wrote to memory of 2620 2660 ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe HD_ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe PID 2668 wrote to memory of 2572 2668 TXPlatforn.exe TXPlatforn.exe PID 2668 wrote to memory of 2572 2668 TXPlatforn.exe TXPlatforn.exe PID 2668 wrote to memory of 2572 2668 TXPlatforn.exe TXPlatforn.exe PID 2668 wrote to memory of 2572 2668 TXPlatforn.exe TXPlatforn.exe PID 2668 wrote to memory of 2572 2668 TXPlatforn.exe TXPlatforn.exe PID 2668 wrote to memory of 2572 2668 TXPlatforn.exe TXPlatforn.exe PID 2668 wrote to memory of 2572 2668 TXPlatforn.exe TXPlatforn.exe PID 2552 wrote to memory of 2584 2552 cmd.exe PING.EXE PID 2552 wrote to memory of 2584 2552 cmd.exe PING.EXE PID 2552 wrote to memory of 2584 2552 cmd.exe PING.EXE PID 2552 wrote to memory of 2584 2552 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe"C:\Users\Admin\AppData\Local\Temp\ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\HD_ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exeC:\Users\Admin\AppData\Local\Temp\HD_ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exe2⤵
- Executes dropped EXE
PID:2620
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.3MB
MD5148828bfc88c9ca5159d76f7dd9f37a5
SHA104a0443d11598c04bd32bc3a80f489fa7dc9221c
SHA2562bd575b79d2fb5b3928d6a1162124d35e73020349cfb3dbfa6a02c275e5776da
SHA5127d1fde36b7990c43cd27cd20a1a8d0662878c94961d86f0f3124a928097c7d121f718e7c78408f9615a947814dc2c066a9079099ad1c95cef65bda4b64612959
-
\Users\Admin\AppData\Local\Temp\HD_ef4fc83d87afafb9b89846a5a6d4edf08a626829d87f4523c97f18c3cf5c56bf.exeFilesize
2.2MB
MD5cd55a17685b496570a9ba3374730a9c5
SHA13127c701297667727854b508a99c71a77fb1f0ea
SHA2566a11cca02e22b01b077775b9819cb220d3747c0f6d2b0b85b13265d0cd3ab730
SHA51219cee89ec5256a386c36c6b3b02f91e8acbf19a778427e5ead10614e73d1dc5e9ed64b1b3b5ad5b461828dea77ba69a5d6b6c8a2363b727ad04f0215da55d894
-
\Users\Admin\AppData\Local\Temp\RVN.exeFilesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
memory/2572-72-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2572-58-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2572-51-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2600-9-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2600-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2600-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2600-5-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2620-27-0x0000000000400000-0x0000000000632000-memory.dmpFilesize
2.2MB
-
memory/2660-25-0x0000000002D40000-0x0000000002F72000-memory.dmpFilesize
2.2MB
-
memory/2660-74-0x0000000002D40000-0x0000000002F72000-memory.dmpFilesize
2.2MB
-
memory/2668-38-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2668-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB