Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 04:08
Static task
static1
Behavioral task
behavioral1
Sample
e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe
Resource
win7-20240508-en
General
-
Target
e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe
-
Size
4.8MB
-
MD5
892d97af99be0df67cba9c7eb22ed652
-
SHA1
3f08f906d3b7b4f5ef001c2f090dcc65ad048cf0
-
SHA256
e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48
-
SHA512
d73d30efca2529c588bd2dde1fbec97b86c3a178a5c8d102914debae9415ec467ada083f2b44f1bca276156ec9def60817714953f85b2328bfc94e5936be89d4
-
SSDEEP
49152:aQZAdVyVT9n/Gg0P+Who9bXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8R:DGdVyVT9nOgmhKbXsPN5kiQaZ56
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3348-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3348-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3348-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/800-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/800-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/800-30-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1012-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1012-40-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1012-42-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1012-63-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/800-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/3348-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3348-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3348-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/800-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/800-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat C:\Windows\SysWOW64\240597562.txt family_gh0strat behavioral2/memory/800-30-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1012-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1012-40-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1012-42-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1012-63-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/800-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240597562.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
Processes:
svchost.exeTXPlatforn.exesvchos.exeTXPlatforn.exeHD_e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 3348 svchost.exe 800 TXPlatforn.exe 1204 svchos.exe 1012 TXPlatforn.exe 1232 HD_e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe 2668 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 3 IoCs
Processes:
svchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 1204 svchos.exe 6072 svchost.exe 2668 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral2/memory/3348-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3348-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3348-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3348-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/800-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/800-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/800-30-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1012-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1012-40-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1012-42-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1012-63-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/800-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/800-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchost.exesvchost.exesvchos.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\240597562.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe -
Drops file in Program Files directory 5 IoCs
Processes:
e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exepid process 3008 e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe 3008 e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 1012 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 3348 svchost.exe Token: SeLoadDriverPrivilege 1012 TXPlatforn.exe Token: 33 1012 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 1012 TXPlatforn.exe Token: 33 1012 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 1012 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exepid process 3008 e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe 3008 e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exesvchost.exeTXPlatforn.execmd.exesvchost.exedescription pid process target process PID 3008 wrote to memory of 3348 3008 e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe svchost.exe PID 3008 wrote to memory of 3348 3008 e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe svchost.exe PID 3008 wrote to memory of 3348 3008 e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe svchost.exe PID 3348 wrote to memory of 3380 3348 svchost.exe cmd.exe PID 3348 wrote to memory of 3380 3348 svchost.exe cmd.exe PID 3348 wrote to memory of 3380 3348 svchost.exe cmd.exe PID 3008 wrote to memory of 1204 3008 e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe svchos.exe PID 3008 wrote to memory of 1204 3008 e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe svchos.exe PID 3008 wrote to memory of 1204 3008 e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe svchos.exe PID 800 wrote to memory of 1012 800 TXPlatforn.exe TXPlatforn.exe PID 800 wrote to memory of 1012 800 TXPlatforn.exe TXPlatforn.exe PID 800 wrote to memory of 1012 800 TXPlatforn.exe TXPlatforn.exe PID 3008 wrote to memory of 1232 3008 e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe HD_e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe PID 3008 wrote to memory of 1232 3008 e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe HD_e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe PID 3008 wrote to memory of 1232 3008 e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe HD_e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe PID 3380 wrote to memory of 3856 3380 cmd.exe PING.EXE PID 3380 wrote to memory of 3856 3380 cmd.exe PING.EXE PID 3380 wrote to memory of 3856 3380 cmd.exe PING.EXE PID 6072 wrote to memory of 2668 6072 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 6072 wrote to memory of 2668 6072 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 6072 wrote to memory of 2668 6072 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe"C:\Users\Admin\AppData\Local\Temp\e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exeC:\Users\Admin\AppData\Local\Temp\HD_e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240597562.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.4MB
MD55d8b8d5459d9cffa3c32e81823b3971d
SHA1efd58b3e745d53406a06809e09b1acc9e11c1ec4
SHA25638fd18e6dc9869b6d7f9ab650bea1dab98d4df9809f1a05862da76771d80731e
SHA512bcaf213ec3ffef5eb68b12f9902559e12f5b66d41ad3348b9d24f31f63ff1db903961fdf3fbae54bb7e2022e650ff2428e19bf364071e7554b69154cd366947a
-
C:\Users\Admin\AppData\Local\Temp\HD_e43ac08147fc910f2f438f48c479771602edc50a197ec3ff50d3f4637cd31b48.exeFilesize
3.1MB
MD5fb083acd60fe5c3156dc25442be815e3
SHA161df59b8f3ebd8b3d29ca3aedc4995e23cacf6d8
SHA256f130b3789962d5c8b59aa250d6f26ad5945928f3905b32bf65aa7bd30348a794
SHA5127147337d2c1006bb15cfa967c9eea6826b63c8d343f866e7454d7368d25019f39e52cf179500810834244c3ca9644d6c0df0b2c3128a9051e9ee6b428fa926f6
-
C:\Users\Admin\AppData\Local\Temp\RCX3B24.tmpFilesize
1.7MB
MD59332d7e23256f8976ab4668f94c732aa
SHA101fe7d0374def8ac847d7533fec959b169fdb693
SHA256a6b5fd73c69d7741c79ea05184081dc2ad82358fc2baaa05d1d6143a63895d6c
SHA512cbb81568446fa3de3e8537aaaad3e51d7dbea1c6d21303ce78b13f08604022dcebf45310981013d29cbd4d21437be61c5a372d18c9f9b39ca6d412963c4e5831
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
C:\Windows\SysWOW64\240597562.txtFilesize
50KB
MD598bd524f630e6c33bfc4976327b59461
SHA16c70b8e795b44b28a075358447e7dadbdf9cdc12
SHA2564ab3febcf02e09bf3b7de30b14d8568cd77d23f654266f7a6f1370490f1df42f
SHA512a7fb3ac05c5b69ad725c100a0058e977e55bf6337e7ac0c2d77d0424f884973d62a8744fa10d4f7f80ab9b80ab4a91fac1650aa692df95841c56897271e13f65
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
memory/800-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/800-30-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/800-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/800-19-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/800-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1012-32-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1012-40-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1012-42-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1012-63-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3348-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3348-10-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3348-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3348-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB