Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 03:35
Static task
static1
Behavioral task
behavioral1
Sample
35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe
Resource
win7-20240508-en
General
-
Target
35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe
-
Size
1.7MB
-
MD5
ce681e55d92faa0e5fa0f797eaab2a1f
-
SHA1
e7e7d41717c4b7239b31f01f9a8992687e6a17d8
-
SHA256
35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1
-
SHA512
8b552ecd8ddabd1650f662d5143abf495b48b244670352c5b7f9d59922b8c2e474dc0ac415dd6a1f10d32ce9ec9db36c28c9b8d6f051e3d54b1d82291f8e0d89
-
SSDEEP
24576:RQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVfM4Y+WN5mmT7KM:RQZAdVyVT9n/Gg0P+WhoVvfKM
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2380-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2380-12-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2380-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2548-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2724-30-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2724-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2548-33-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2724-40-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2724-41-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/2380-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2380-12-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2380-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2548-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2724-30-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2724-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat \Windows\SysWOW64\259401925.txt family_gh0strat behavioral1/memory/2548-33-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2724-40-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2724-41-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259401925.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 5 IoCs
Processes:
svchost.exeTXPlatforn.exeTXPlatforn.exesvchos.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2380 svchost.exe 2548 TXPlatforn.exe 2724 TXPlatforn.exe 2580 svchos.exe 1624 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 7 IoCs
Processes:
35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exeTXPlatforn.exesvchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2928 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe 2548 TXPlatforn.exe 2928 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe 2580 svchos.exe 1176 svchost.exe 1176 svchost.exe 1624 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral1/memory/2380-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2380-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2380-12-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2380-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2548-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2724-30-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2724-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2548-33-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2724-40-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2724-41-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchos.exesvchost.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\259401925.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2724 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2380 svchost.exe Token: SeLoadDriverPrivilege 2724 TXPlatforn.exe Token: 33 2724 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2724 TXPlatforn.exe Token: 33 2724 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2724 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exepid process 2928 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe 2928 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exeTXPlatforn.exesvchost.execmd.exesvchost.exedescription pid process target process PID 2928 wrote to memory of 2380 2928 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe svchost.exe PID 2928 wrote to memory of 2380 2928 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe svchost.exe PID 2928 wrote to memory of 2380 2928 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe svchost.exe PID 2928 wrote to memory of 2380 2928 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe svchost.exe PID 2928 wrote to memory of 2380 2928 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe svchost.exe PID 2928 wrote to memory of 2380 2928 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe svchost.exe PID 2928 wrote to memory of 2380 2928 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe svchost.exe PID 2548 wrote to memory of 2724 2548 TXPlatforn.exe TXPlatforn.exe PID 2548 wrote to memory of 2724 2548 TXPlatforn.exe TXPlatforn.exe PID 2548 wrote to memory of 2724 2548 TXPlatforn.exe TXPlatforn.exe PID 2548 wrote to memory of 2724 2548 TXPlatforn.exe TXPlatforn.exe PID 2548 wrote to memory of 2724 2548 TXPlatforn.exe TXPlatforn.exe PID 2548 wrote to memory of 2724 2548 TXPlatforn.exe TXPlatforn.exe PID 2548 wrote to memory of 2724 2548 TXPlatforn.exe TXPlatforn.exe PID 2380 wrote to memory of 2684 2380 svchost.exe cmd.exe PID 2380 wrote to memory of 2684 2380 svchost.exe cmd.exe PID 2380 wrote to memory of 2684 2380 svchost.exe cmd.exe PID 2380 wrote to memory of 2684 2380 svchost.exe cmd.exe PID 2928 wrote to memory of 2580 2928 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe svchos.exe PID 2928 wrote to memory of 2580 2928 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe svchos.exe PID 2928 wrote to memory of 2580 2928 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe svchos.exe PID 2928 wrote to memory of 2580 2928 35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe svchos.exe PID 2684 wrote to memory of 2568 2684 cmd.exe PING.EXE PID 2684 wrote to memory of 2568 2684 cmd.exe PING.EXE PID 2684 wrote to memory of 2568 2684 cmd.exe PING.EXE PID 2684 wrote to memory of 2568 2684 cmd.exe PING.EXE PID 1176 wrote to memory of 1624 1176 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 1176 wrote to memory of 1624 1176 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 1176 wrote to memory of 1624 1176 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 1176 wrote to memory of 1624 1176 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe"C:\Users\Admin\AppData\Local\Temp\35f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259401925.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.7MB
MD5ce681e55d92faa0e5fa0f797eaab2a1f
SHA1e7e7d41717c4b7239b31f01f9a8992687e6a17d8
SHA25635f3ad83820c64944f34e1104aead337bbb8b0fd4920fa595ac787f0dca694f1
SHA5128b552ecd8ddabd1650f662d5143abf495b48b244670352c5b7f9d59922b8c2e474dc0ac415dd6a1f10d32ce9ec9db36c28c9b8d6f051e3d54b1d82291f8e0d89
-
C:\Users\Admin\AppData\Local\Temp\X.icoFilesize
71KB
MD5fb44f7af2882d222b600539171f54c1d
SHA10c5a1a0b1620a55a0f194464227be25a2f0347e1
SHA256f2a78e76259bc8fd4ab6af7b4e16dfb49a10643308aca3d14c09e61ac0ebd487
SHA51221e906473f64303c4c8d55213ccb84f4a803c11fb5eef34ce3194adfb391ccbcc91e7c399556c7a4e4f3d33b9b19524d4499ec771ee8e1a10df26ea7cc2dcb67
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
\Windows\SysWOW64\259401925.txtFilesize
50KB
MD529c3e87fb26656f1a1b727d34d8fd844
SHA10a1752aaf3604340d1ded9637aa77d76262cc0f6
SHA256f21db0e1c83a1c932cccc4f62156d8ea5f627eb12e1160fda8d7281840853252
SHA512e3cb1f2e16936ab3104a2f413fd079fb9dc8af611caa4d6d4bcc46e33dbdb456d3b0e1c2dc0eaf03a31c3bdc9581f1eb3a67297f4a76c82e8f231cdf3d1709b6
-
memory/2380-5-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2380-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2380-12-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2380-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2548-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2548-33-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2724-32-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2724-41-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2724-40-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2724-30-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB