Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 19:10
Static task
static1
Behavioral task
behavioral1
Sample
c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe
Resource
win7-20240220-en
General
-
Target
c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe
-
Size
1.7MB
-
MD5
2f044e006395ed94c494788b44c96782
-
SHA1
f9bde1dc9be53df56db9e56520cf3632ecc3914b
-
SHA256
c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd
-
SHA512
01994ad06a55bc4223bf4bc60226eb6de3db3d84d8dc9a408705b0282b9f495a81c4f5c76edb6a19c7923d47161ae9df611bd8215a5b2a30bcfb05d917194f40
-
SSDEEP
24576:NQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVzILUsWAsXILeiWA:NQZAdVyVT9n/Gg0P+Whoc4Fa4V
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2564-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2564-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2564-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1344-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1344-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3388-53-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3388-68-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3388-52-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3388-89-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3388-90-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1344-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1344-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 13 IoCs
Processes:
resource yara_rule behavioral2/memory/2564-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2564-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2564-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1344-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1344-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat C:\Windows\SysWOW64\240600515.txt family_gh0strat behavioral2/memory/3388-53-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3388-68-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3388-52-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3388-89-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3388-90-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1344-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1344-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240600515.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
Processes:
svchost.exeTXPlatforn.exeTXPlatforn.exesvchos.exeHD_c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2564 svchost.exe 1344 TXPlatforn.exe 3388 TXPlatforn.exe 3596 svchos.exe 1668 HD_c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe 3020 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 3 IoCs
Processes:
svchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 3596 svchos.exe 4432 svchost.exe 3020 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral2/memory/2564-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2564-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2564-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2564-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1344-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1344-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1344-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3388-50-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3388-53-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3388-68-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3388-52-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3388-89-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3388-90-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1344-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1344-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchos.exesvchost.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\240600515.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe -
Drops file in Program Files directory 5 IoCs
Processes:
c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exepid process 1108 c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe 1108 c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 3388 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2564 svchost.exe Token: SeLoadDriverPrivilege 3388 TXPlatforn.exe Token: 33 3388 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 3388 TXPlatforn.exe Token: 33 3388 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 3388 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exepid process 1108 c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe 1108 c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exeTXPlatforn.exesvchost.execmd.exesvchost.exedescription pid process target process PID 1108 wrote to memory of 2564 1108 c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe svchost.exe PID 1108 wrote to memory of 2564 1108 c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe svchost.exe PID 1108 wrote to memory of 2564 1108 c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe svchost.exe PID 1344 wrote to memory of 3388 1344 TXPlatforn.exe TXPlatforn.exe PID 1344 wrote to memory of 3388 1344 TXPlatforn.exe TXPlatforn.exe PID 1344 wrote to memory of 3388 1344 TXPlatforn.exe TXPlatforn.exe PID 2564 wrote to memory of 2524 2564 svchost.exe cmd.exe PID 2564 wrote to memory of 2524 2564 svchost.exe cmd.exe PID 2564 wrote to memory of 2524 2564 svchost.exe cmd.exe PID 1108 wrote to memory of 3596 1108 c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe svchos.exe PID 1108 wrote to memory of 3596 1108 c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe svchos.exe PID 1108 wrote to memory of 3596 1108 c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe svchos.exe PID 1108 wrote to memory of 1668 1108 c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe HD_c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe PID 1108 wrote to memory of 1668 1108 c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe HD_c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe PID 1108 wrote to memory of 1668 1108 c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe HD_c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe PID 2524 wrote to memory of 4008 2524 cmd.exe PING.EXE PID 2524 wrote to memory of 4008 2524 cmd.exe PING.EXE PID 2524 wrote to memory of 4008 2524 cmd.exe PING.EXE PID 4432 wrote to memory of 3020 4432 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 4432 wrote to memory of 3020 4432 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 4432 wrote to memory of 3020 4432 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe"C:\Users\Admin\AppData\Local\Temp\c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exeC:\Users\Admin\AppData\Local\Temp\HD_c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240600515.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.5MB
MD5cce1a859ab03da5a5208ac4e93a799f8
SHA15f0608604dc0097334782d9663b33a6c29340920
SHA256021ae8545a112b014928a7763becf50336672d5a54901e6e91b8a4f9a52e55ca
SHA51244dbe159fb5853160f6c88fa79cf2422b68a2e1f549f3779426e9350cc159a7997e36853eb1670a0de668c100387dc2ddd4227b540c3c2f6f8b66dd318ac8a6a
-
C:\Users\Admin\AppData\Local\Temp\HD_c58c9e31bb8e4ae3aa7e365babb436eeaba1ffbcdc36ccb9b59910c6778717dd.exeFilesize
226KB
MD5b2b65f2569b7940e6d9152e87b5c86e8
SHA1af3db7d76e5b46fd375689213145e9349cf34bb8
SHA256e79e17925b72439954264b511a635e7750bafb178b7f17e9eb03648cabe209d0
SHA512c683e1d8f8ac752e02f1896964b9b131d5a44be6e621886b0da134f28f58da1494d19eeb32f6452aab0080d95969b55a3351925ebe0fd8ba42896dd81c0e3da5
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
C:\Windows\SysWOW64\240600515.txtFilesize
50KB
MD573d01d8f207d1948738fff1559a2d743
SHA1ac2bb513b2413f92e02009fb6a64dae7859891d5
SHA256a1ce576b8c94ae3dac6e74b61adfb121ccf7886e2da27dd59394162ea259c9bc
SHA51248a48593166039e2439ea333b6a6ce5d6235999769a1ed63bbb844398ae3389d3b282783c45a35e23e72d5992f549d9ad1e889ebe7d69754a1c5ba5863ffc894
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
memory/1344-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1344-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1344-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1344-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1344-19-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2564-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2564-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2564-10-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2564-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3388-68-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3388-90-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3388-89-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3388-52-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3388-53-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3388-50-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB