Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 17:05
Static task
static1
Behavioral task
behavioral1
Sample
975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe
Resource
win7-20240221-en
General
-
Target
975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe
-
Size
1.8MB
-
MD5
2ecaad895fd81f043b09fc3fe37bdf32
-
SHA1
7ba3c0b70adbb9671cc4a800bcc515cd2352d04b
-
SHA256
975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9
-
SHA512
f31cdf0b9b79b33f7348a13f78fc80e7741ea627b489d909f8dbd8f181edecad414214110f8e74e80559c6ac1eb4dcee67a861e0151d68d89dcb36b669b9537c
-
SSDEEP
24576:ZQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVoI4HArOZDIXwqglte:ZQZAdVyVT9n/Gg0P+WhogrOKwqAw
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2076-11-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2076-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2076-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2812-27-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/3024-34-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/3024-37-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/3024-49-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/2076-11-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2076-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2076-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat \Windows\SysWOW64\259436105.txt family_gh0strat behavioral1/memory/2812-27-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/3024-34-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/3024-37-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/3024-49-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259436105.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 7 IoCs
Processes:
svchost.exeTXPlatforn.exesvchos.exeTXPlatforn.exeHD_975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2076 svchost.exe 2812 TXPlatforn.exe 2776 svchos.exe 3024 TXPlatforn.exe 2500 HD_975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe 1200 2844 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 8 IoCs
Processes:
975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exeTXPlatforn.exesvchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe 2812 TXPlatforn.exe 2776 svchos.exe 2632 svchost.exe 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe 2632 svchost.exe 2844 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral1/memory/2076-11-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2076-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2076-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2076-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2812-27-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/3024-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/3024-37-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/3024-49-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchost.exesvchost.exesvchos.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\259436105.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exedescription ioc process File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exeHD_975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exepid process 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe 2500 HD_975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe 2500 HD_975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 3024 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2076 svchost.exe Token: SeLoadDriverPrivilege 3024 TXPlatforn.exe Token: 33 3024 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 3024 TXPlatforn.exe Token: 33 3024 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 3024 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exepid process 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exesvchost.exeTXPlatforn.execmd.exesvchost.exedescription pid process target process PID 1640 wrote to memory of 2076 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe svchost.exe PID 1640 wrote to memory of 2076 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe svchost.exe PID 1640 wrote to memory of 2076 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe svchost.exe PID 1640 wrote to memory of 2076 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe svchost.exe PID 1640 wrote to memory of 2076 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe svchost.exe PID 1640 wrote to memory of 2076 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe svchost.exe PID 1640 wrote to memory of 2076 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe svchost.exe PID 2076 wrote to memory of 1388 2076 svchost.exe cmd.exe PID 2076 wrote to memory of 1388 2076 svchost.exe cmd.exe PID 2076 wrote to memory of 1388 2076 svchost.exe cmd.exe PID 2076 wrote to memory of 1388 2076 svchost.exe cmd.exe PID 1640 wrote to memory of 2776 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe svchos.exe PID 1640 wrote to memory of 2776 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe svchos.exe PID 1640 wrote to memory of 2776 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe svchos.exe PID 1640 wrote to memory of 2776 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe svchos.exe PID 2812 wrote to memory of 3024 2812 TXPlatforn.exe TXPlatforn.exe PID 2812 wrote to memory of 3024 2812 TXPlatforn.exe TXPlatforn.exe PID 2812 wrote to memory of 3024 2812 TXPlatforn.exe TXPlatforn.exe PID 2812 wrote to memory of 3024 2812 TXPlatforn.exe TXPlatforn.exe PID 2812 wrote to memory of 3024 2812 TXPlatforn.exe TXPlatforn.exe PID 2812 wrote to memory of 3024 2812 TXPlatforn.exe TXPlatforn.exe PID 2812 wrote to memory of 3024 2812 TXPlatforn.exe TXPlatforn.exe PID 1388 wrote to memory of 2524 1388 cmd.exe PING.EXE PID 1388 wrote to memory of 2524 1388 cmd.exe PING.EXE PID 1388 wrote to memory of 2524 1388 cmd.exe PING.EXE PID 1388 wrote to memory of 2524 1388 cmd.exe PING.EXE PID 1640 wrote to memory of 2500 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe HD_975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe PID 1640 wrote to memory of 2500 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe HD_975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe PID 1640 wrote to memory of 2500 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe HD_975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe PID 1640 wrote to memory of 2500 1640 975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe HD_975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe PID 2632 wrote to memory of 2844 2632 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2632 wrote to memory of 2844 2632 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2632 wrote to memory of 2844 2632 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2632 wrote to memory of 2844 2632 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe"C:\Users\Admin\AppData\Local\Temp\975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\HD_975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exeC:\Users\Admin\AppData\Local\Temp\HD_975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2500
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵PID:2592
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259436105.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\VideoLAN\VLC\vlc.exeFilesize
2.2MB
MD540450e32dbeb6cf0dd9d1dada6d642dc
SHA194d0bbadedb827b6ef50fd04c3246f908b567c5b
SHA256a182319b52700801102f48bfd08f6f8db7c102ccaf3242bff691a8e5124d4d93
SHA5129fc77ec616ea907acda5cd551eef396058a8f0220ebe40e645ab511111cdde0c643b473b9bb8e15aa2479a219e63b806bf6722e49666960cc12d20f62b2bc705
-
C:\Users\Admin\AppData\Local\Temp\HD_975bd24f432ef6fb752135929172444d5f4602725d6a11d6ef04580212f4bbd9.exeFilesize
551KB
MD5b65ea506c7a0d4b311f2b9feb351bec8
SHA11877ab89f073585c35748e5c46d5f3b958e81a99
SHA2568a0fbca6cbfd1d70779cf177423f02924354f4edc30f1ba8ab18d044b2a26173
SHA512fd2f906d30dface15ccf9527ef20f0195bcde1ff6b1400ab59c3bc73e5963ca317045b2abca7158bc86215f1629033272e30839fe4edb6e5422bcc4f481e6d7a
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.2MB
MD576fc2bbff11f94e47f0ecd70ecc2da6f
SHA11dd2806048b4eac4256bab3b3322508e3bb4c51a
SHA256e0a583d4db7adc48236b1cbe70dac1ee631dff1c18e44ad178c3b84012176e90
SHA512ac3700b6223d89cdcee6e597f290850732678192bfeb0d7d792a4fd5436f1232005dc8fe19822671534851daa506c6d4521e0a023a1cf4b2a2542f3d2139beaf
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
\Windows\SysWOW64\259436105.txtFilesize
50KB
MD5cf51af2aa9f677ec8e2af91fd45bf937
SHA1e45841385cfafc9791de516fd241f97be1b95442
SHA256ef4f4749a99fbd7e7c08d4b80cd17cd81e0d5fb9b3894c5804d39c21c85fba20
SHA512dfdc6bfbc4f3b48094e1bce7e59b080466e6a35bb8cc4403b56ab490566d1ffa7a2979d919ca15158f3f125edc3a2fc6bf792bdfc5ce53ed761a75cac2891721
-
\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
memory/2076-5-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2076-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2076-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2076-11-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2812-27-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3024-34-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3024-37-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3024-49-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB