Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 19:38
Static task
static1
Behavioral task
behavioral1
Sample
c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exe
Resource
win7-20240419-en
General
-
Target
c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exe
-
Size
1.3MB
-
MD5
73bb2437470e04e4eb642f97e7f9f367
-
SHA1
cf164b20e8310506c65beb17382eb97f797f65cd
-
SHA256
c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc
-
SHA512
a4f2969eb71b7d786a171fc720b8726d9f94291d652620b10d3db31e8205d25147a28cf462b7322f951af883277d432d3b2c60f95dc8f39cffd677b22209b324
-
SSDEEP
24576:x09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+nwped:x09XJt4HIN2H2tFvduyS+ped
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2816-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2816-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2816-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1596-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1596-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1700-26-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1596-25-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1700-41-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1700-40-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1700-24-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1596-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/2816-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2816-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2816-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1596-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1596-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1700-26-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1596-25-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1700-41-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1700-40-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1700-24-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1596-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 3 IoCs
Processes:
RVN.exeTXPlatforn.exeTXPlatforn.exepid process 2816 RVN.exe 1596 TXPlatforn.exe 1700 TXPlatforn.exe -
Processes:
resource yara_rule behavioral2/memory/2816-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2816-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2816-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2816-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1596-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1596-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1596-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1700-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1596-25-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1700-41-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1700-40-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1700-24-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1596-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
RVN.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 5 IoCs
Processes:
c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 1700 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RVN.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2816 RVN.exe Token: SeLoadDriverPrivilege 1700 TXPlatforn.exe Token: 33 1700 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 1700 TXPlatforn.exe Token: 33 1700 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 1700 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exepid process 4352 c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exe 4352 c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exeRVN.exeTXPlatforn.execmd.exedescription pid process target process PID 4352 wrote to memory of 2816 4352 c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exe RVN.exe PID 4352 wrote to memory of 2816 4352 c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exe RVN.exe PID 4352 wrote to memory of 2816 4352 c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exe RVN.exe PID 2816 wrote to memory of 4932 2816 RVN.exe cmd.exe PID 2816 wrote to memory of 4932 2816 RVN.exe cmd.exe PID 2816 wrote to memory of 4932 2816 RVN.exe cmd.exe PID 1596 wrote to memory of 1700 1596 TXPlatforn.exe TXPlatforn.exe PID 1596 wrote to memory of 1700 1596 TXPlatforn.exe TXPlatforn.exe PID 1596 wrote to memory of 1700 1596 TXPlatforn.exe TXPlatforn.exe PID 4932 wrote to memory of 1472 4932 cmd.exe PING.EXE PID 4932 wrote to memory of 1472 4932 cmd.exe PING.EXE PID 4932 wrote to memory of 1472 4932 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exe"C:\Users\Admin\AppData\Local\Temp\c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.3MB
MD573bb2437470e04e4eb642f97e7f9f367
SHA1cf164b20e8310506c65beb17382eb97f797f65cd
SHA256c389a8e9408618c1e1807867bbd0a8d81ea32d1df61a5e176cc1033e9e158bbc
SHA512a4f2969eb71b7d786a171fc720b8726d9f94291d652620b10d3db31e8205d25147a28cf462b7322f951af883277d432d3b2c60f95dc8f39cffd677b22209b324
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.6MB
MD5ce62fef40594ad7b8fc71fb09bba355d
SHA14d9f3bc688eedd0f86595f5b2da775f9ff314f56
SHA2566d2f76f3ce4d8326143b43fbaa421f4ac363031f34a5745f01665d031c41b456
SHA5122e287f6b2096692722a801747349b095aa70f61f4ff46c139f5339d3032ea39a92442c1d93e092a19a4d53a2c299d68ad214756b0a3c59c6ea2430f2a9a732ee
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeFilesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
memory/1596-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1596-25-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1596-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1596-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1596-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1700-40-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1700-26-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1700-41-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1700-24-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2816-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2816-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2816-10-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2816-5-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB