Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 20:17
Static task
static1
Behavioral task
behavioral1
Sample
9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe
Resource
win7-20240221-en
General
-
Target
9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe
-
Size
12.2MB
-
MD5
c0749da6e81d81ccd06b9456e70ca502
-
SHA1
7657c0b07e855399195f8279d67d587196e00b20
-
SHA256
9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a
-
SHA512
101aaaa56da8c30a08b53696763332727e82e6214847157d7a76593ddde28bf176304bd1ba307b772bb90808b412f0821ddd1eb933dec63bd76f807264c8cc5b
-
SSDEEP
196608:FWT9nO78MCSfR6m5VPyBiifMrVOMS/V8MQOj+GcBf7/x5e/tylQlfXlnBzDFu+97:H78BsPT0ii0rW/uMQObo7jayKrBv8Ykw
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3572-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3572-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3572-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4636-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4636-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4636-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3572-20-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4636-21-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/5088-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/5088-30-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/5088-33-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/5088-39-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 13 IoCs
Processes:
resource yara_rule behavioral2/memory/3572-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3572-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3572-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4636-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4636-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4636-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3572-20-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4636-21-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/5088-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/5088-30-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/5088-33-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat C:\Windows\SysWOW64\240652781.txt family_gh0strat behavioral2/memory/5088-39-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240652781.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
Processes:
svchost.exeTXPlatforn.exeTXPlatforn.exesvchos.exeHD_9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 3572 svchost.exe 4636 TXPlatforn.exe 5088 TXPlatforn.exe 4968 svchos.exe 4500 HD_9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe 4388 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 3 IoCs
Processes:
svchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 4968 svchos.exe 1188 svchost.exe 4388 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral2/memory/3572-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3572-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3572-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3572-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4636-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4636-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4636-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4636-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3572-20-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4636-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5088-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5088-30-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5088-33-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5088-39-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchost.exesvchos.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\240652781.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe -
Drops file in Program Files directory 5 IoCs
Processes:
9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exedescription ioc process File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exepid process 4136 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe 4136 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 5088 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 3572 svchost.exe Token: SeLoadDriverPrivilege 5088 TXPlatforn.exe Token: 33 5088 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 5088 TXPlatforn.exe Token: 33 5088 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 5088 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exepid process 4136 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe 4136 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exesvchost.exeTXPlatforn.execmd.exesvchost.exedescription pid process target process PID 4136 wrote to memory of 3572 4136 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe svchost.exe PID 4136 wrote to memory of 3572 4136 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe svchost.exe PID 4136 wrote to memory of 3572 4136 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe svchost.exe PID 3572 wrote to memory of 1452 3572 svchost.exe cmd.exe PID 3572 wrote to memory of 1452 3572 svchost.exe cmd.exe PID 3572 wrote to memory of 1452 3572 svchost.exe cmd.exe PID 4636 wrote to memory of 5088 4636 TXPlatforn.exe TXPlatforn.exe PID 4636 wrote to memory of 5088 4636 TXPlatforn.exe TXPlatforn.exe PID 4636 wrote to memory of 5088 4636 TXPlatforn.exe TXPlatforn.exe PID 4136 wrote to memory of 4968 4136 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe svchos.exe PID 4136 wrote to memory of 4968 4136 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe svchos.exe PID 4136 wrote to memory of 4968 4136 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe svchos.exe PID 1452 wrote to memory of 2428 1452 cmd.exe PING.EXE PID 1452 wrote to memory of 2428 1452 cmd.exe PING.EXE PID 1452 wrote to memory of 2428 1452 cmd.exe PING.EXE PID 4136 wrote to memory of 4500 4136 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe HD_9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe PID 4136 wrote to memory of 4500 4136 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe HD_9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe PID 4136 wrote to memory of 4500 4136 9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe HD_9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe PID 1188 wrote to memory of 4388 1188 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 1188 wrote to memory of 4388 1188 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 1188 wrote to memory of 4388 1188 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe"C:\Users\Admin\AppData\Local\Temp\9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exeC:\Users\Admin\AppData\Local\Temp\HD_9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240652781.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_9c8389a96ed4eea43ac294c341d0997248631defda791d728f092ea9e713529a.exeFilesize
10.7MB
MD5f023cf8fa8730d21bae5b7ce09acbaac
SHA1dda2569344f0463213ce056925aa6ece02da5d0b
SHA25613a32099d2772e9059ad9a8c1896ccaafbf446f33fc5cfb5ed16e28ef3383934
SHA512551169868bf26eea658d434c4c582f51df339694127125da544713fd46c90e3038a6fd85ba0257f298b65a79f1e923848607f88703a2721e00b960c19433f658
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.3MB
MD5f50d9e6461f639354fb6566119db276a
SHA1999e63ba16dfee844d0471411ea1eca9734563d3
SHA256b45ad6ed5bb7a28076124c6a77f789676dc16f9d4ee927db526f1b9a8ad24515
SHA512c236a3dcf3803639cc8a96b18273917565072c88cde5745d68e31b2da97fd290e08f21edaf89c7583825be448e72722bc6560419bb0a3fca8f24d19bdd100bef
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.5MB
MD55cbfe1b5c4714fca45b2716eb794dc80
SHA12565dfbd7b86daa990962a0aef8b9233fb59745f
SHA256ba0814f012e26ba7f809bc1e415f164256f7306ea87317a68a2eb079d55789ad
SHA5120e0410783d4d688f6596a7348f5210d37cdf6e13fea301b40d478839f45a6504b559bb6851ff8fd708ae0bb802fbb28ed4c5dae78e0ee1851bef9e2fdd0c2a63
-
C:\Users\Admin\AppData\Local\Temp\X.icoFilesize
69KB
MD5e33fb6d686b1a8b171349572c5a33f67
SHA129f24fe536adf799b69b63c83efadc1bce457a54
SHA256020c8e0963f89f4b14538b7d69e83c6fec44a29bbbd52fbb6deb2be5c697f450
SHA512cf1f1d6a9efe53f84e5b4a8246b87c0b96496716605d1b00352d9aae30e664d3d2cbadebf598b4e690a9feef0b5785887a4e643cc5f68938ca744af1d3539e55
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
C:\Windows\SysWOW64\240652781.txtFilesize
50KB
MD5b81215ee5c9507884fa92db97308c817
SHA1642df45bd69633ffe2303235e3dc1cf361caebcf
SHA2565d69b1cb3ca04ee9216d82cf4a7459282617576c9262636f077fa841e813abbe
SHA512fe53feec672defe9afdd64ec703749a43854ecbc145d24da461958900c23d254c7f6c702aa16e01b8e834707a4cfe227a226aa3c5810a1877ffe51722ae57a44
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
memory/3572-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3572-20-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3572-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3572-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3572-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4636-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4636-21-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4636-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4636-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4636-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5088-33-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5088-30-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5088-39-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5088-29-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB