Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 04:07
Static task
static1
Behavioral task
behavioral1
Sample
6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe
Resource
win7-20240508-en
General
-
Target
6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe
-
Size
3.8MB
-
MD5
d01f129bcabff635dba34c3775ef7d1f
-
SHA1
1f67cf1499111ccec289072013f558b363957389
-
SHA256
6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb
-
SHA512
81e617110f4eb12af71542fa56c3c7d671b0aa9b56a0d3be9aca43a05be4c6413d305551d11f1d7834b2ba3c28fc64c79de1105bf8f3cc3ae328a4d8684f9301
-
SSDEEP
49152:OQZAdVyVT9n/Gg0P+Who2Syn2yZ/s5w7Ab95SagnzK3K+rts9qEAFWrzsR0cTyjz:fGdVyVT9nOgmhtSyn2dekrusgrYIjz
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2068-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2068-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2132-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2068-26-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2616-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2616-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2132-28-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2616-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2616-39-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2616-41-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/2068-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2068-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2132-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2068-26-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2616-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2616-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat \Windows\SysWOW64\259400038.txt family_gh0strat behavioral1/memory/2132-28-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2616-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2616-39-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2616-41-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259400038.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
Processes:
svchost.exeTXPlatforn.exesvchos.exeTXPlatforn.exeHD_6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2068 svchost.exe 2132 TXPlatforn.exe 2672 svchos.exe 2616 TXPlatforn.exe 2632 HD_6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe 468 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 8 IoCs
Processes:
6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exeTXPlatforn.exesvchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe 2132 TXPlatforn.exe 2672 svchos.exe 2636 svchost.exe 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe 2636 svchost.exe 468 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral1/memory/2068-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2068-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2068-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2132-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2068-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2616-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2616-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2616-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2132-28-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2616-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2616-39-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2616-41-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchos.exesvchost.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\259400038.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exepid process 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2616 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2068 svchost.exe Token: SeLoadDriverPrivilege 2616 TXPlatforn.exe Token: 33 2616 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2616 TXPlatforn.exe Token: 33 2616 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2616 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exepid process 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exesvchost.exeTXPlatforn.execmd.exesvchost.exedescription pid process target process PID 2268 wrote to memory of 2068 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe svchost.exe PID 2268 wrote to memory of 2068 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe svchost.exe PID 2268 wrote to memory of 2068 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe svchost.exe PID 2268 wrote to memory of 2068 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe svchost.exe PID 2268 wrote to memory of 2068 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe svchost.exe PID 2268 wrote to memory of 2068 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe svchost.exe PID 2268 wrote to memory of 2068 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe svchost.exe PID 2068 wrote to memory of 2608 2068 svchost.exe cmd.exe PID 2068 wrote to memory of 2608 2068 svchost.exe cmd.exe PID 2068 wrote to memory of 2608 2068 svchost.exe cmd.exe PID 2068 wrote to memory of 2608 2068 svchost.exe cmd.exe PID 2268 wrote to memory of 2672 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe svchos.exe PID 2268 wrote to memory of 2672 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe svchos.exe PID 2268 wrote to memory of 2672 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe svchos.exe PID 2268 wrote to memory of 2672 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe svchos.exe PID 2132 wrote to memory of 2616 2132 TXPlatforn.exe TXPlatforn.exe PID 2132 wrote to memory of 2616 2132 TXPlatforn.exe TXPlatforn.exe PID 2132 wrote to memory of 2616 2132 TXPlatforn.exe TXPlatforn.exe PID 2132 wrote to memory of 2616 2132 TXPlatforn.exe TXPlatforn.exe PID 2132 wrote to memory of 2616 2132 TXPlatforn.exe TXPlatforn.exe PID 2132 wrote to memory of 2616 2132 TXPlatforn.exe TXPlatforn.exe PID 2132 wrote to memory of 2616 2132 TXPlatforn.exe TXPlatforn.exe PID 2608 wrote to memory of 2708 2608 cmd.exe PING.EXE PID 2608 wrote to memory of 2708 2608 cmd.exe PING.EXE PID 2608 wrote to memory of 2708 2608 cmd.exe PING.EXE PID 2608 wrote to memory of 2708 2608 cmd.exe PING.EXE PID 2268 wrote to memory of 2632 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe HD_6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe PID 2268 wrote to memory of 2632 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe HD_6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe PID 2268 wrote to memory of 2632 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe HD_6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe PID 2268 wrote to memory of 2632 2268 6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe HD_6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe PID 2636 wrote to memory of 468 2636 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2636 wrote to memory of 468 2636 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2636 wrote to memory of 468 2636 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2636 wrote to memory of 468 2636 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe"C:\Users\Admin\AppData\Local\Temp\6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\HD_6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exeC:\Users\Admin\AppData\Local\Temp\HD_6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe2⤵
- Executes dropped EXE
PID:2632
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵PID:2520
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259400038.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5bd2d3ed9ff2830ed9c464a63f392bea6
SHA1085ffd9e861782f753e1bbb7ab3425d905d5c9d2
SHA25683af642e15669729351fc657af0b64fecca919c0622c20f963332ad733ed2117
SHA512f4845164d64e45650231079ad4c52bf8c2a879201727633bff809f8a42a6efb2c5ad7bf1e41adee6332b7dca99e878a667dcca39920658246a83caa98a7238f5
-
Filesize
1.6MB
MD5b209e9054fcc9fd47ba5acd3af4fa62e
SHA1e2221583699e772d50adef5297c6cc49be7cc904
SHA256f1f2291599841f2a10b26cfe2514f745e5ae2502cbbfe055616174006f118d2c
SHA51207d7a95e8565c0e670230698aa6bd0ec99c72445dcf8f37d405584e5498832a46dc4ea80cd57b17d52ace80be70a3ad57d50bf24a57281bfaecf3efd21b1a449
-
\Users\Admin\AppData\Local\Temp\HD_6075ce57b120917839b2049a2269accb70aaf745d9bf46721f113f0c3e65e5cb.exe
Filesize2.1MB
MD5391fcf5c3b2898036af882d647444599
SHA1359adcf02f64b9215b8a90c0b92bfcd74a894128
SHA2561a89c812630805cc1f876eb2969aa1f88591b18de2a85fa50f7228b1f78f464c
SHA51282d3bcab21ee33926da4515f35a3caaa45404382e596c32b4895f8a2cf753a29053344bccd8e8a18c3826aed9a97add8d94ec0cef965fac5d31dced652bdad5a
-
Filesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
Filesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
Filesize
50KB
MD583c3e3133c0c46d4c3ab7a2bef71c200
SHA105a6428f2b6342a5faa9d81b0ba723dc3cc119fe
SHA25676be5bac8fc697f342c83d085cda0a11b284df530dfe85af4b1d72f4299a3a23
SHA512d370b546f04c7af4a4b59d32792e015ba5cda3f447dd582f45e81f686ab3a7eba3adac101793484d41126922ef1cc049b90168c283aedd2cd3ac822d86ec5f31
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d