Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 06:18
Static task
static1
Behavioral task
behavioral1
Sample
276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe
Resource
win7-20240508-en
General
-
Target
276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe
-
Size
1.9MB
-
MD5
f40302c74f2d02c4106a8884710dd8c5
-
SHA1
40ad5418278de7f9eb99237c47b6d0dd576d98c4
-
SHA256
276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4
-
SHA512
33a0163b5f203cda2c9f58277a7e8dc02d9a4bd50824ff47dcf74dfacac81a125bb1842b8a9c469273ead162512d6fb16de86ab386ae138f78f33079384ed9c7
-
SSDEEP
24576:HQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cV6BGV1Dfun2P:HQZAdVyVT9n/Gg0P+WhoIDmn2P
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2008-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2008-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2008-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2008-21-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2256-24-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2284-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2284-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2256-37-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2284-38-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/2008-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2008-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2008-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2008-21-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2256-24-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2284-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2284-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2256-37-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2284-38-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat \Windows\SysWOW64\259401972.txt family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259401972.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 5 IoCs
Processes:
svchost.exeTXPlatforn.exesvchos.exeTXPlatforn.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2008 svchost.exe 2256 TXPlatforn.exe 2332 svchos.exe 2284 TXPlatforn.exe 2972 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 7 IoCs
Processes:
276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exeTXPlatforn.exesvchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 3056 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe 3056 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe 2256 TXPlatforn.exe 2332 svchos.exe 2584 svchost.exe 2584 svchost.exe 2972 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral1/memory/2008-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2008-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2008-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2008-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2008-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2256-24-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2284-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2284-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2256-37-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2284-38-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchost.exesvchos.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\259401972.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2284 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2008 svchost.exe Token: SeLoadDriverPrivilege 2284 TXPlatforn.exe Token: 33 2284 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2284 TXPlatforn.exe Token: 33 2284 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2284 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exepid process 3056 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe 3056 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exesvchost.exeTXPlatforn.execmd.exesvchost.exedescription pid process target process PID 3056 wrote to memory of 2008 3056 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe svchost.exe PID 3056 wrote to memory of 2008 3056 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe svchost.exe PID 3056 wrote to memory of 2008 3056 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe svchost.exe PID 3056 wrote to memory of 2008 3056 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe svchost.exe PID 3056 wrote to memory of 2008 3056 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe svchost.exe PID 3056 wrote to memory of 2008 3056 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe svchost.exe PID 3056 wrote to memory of 2008 3056 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe svchost.exe PID 2008 wrote to memory of 2292 2008 svchost.exe cmd.exe PID 2008 wrote to memory of 2292 2008 svchost.exe cmd.exe PID 2008 wrote to memory of 2292 2008 svchost.exe cmd.exe PID 2008 wrote to memory of 2292 2008 svchost.exe cmd.exe PID 3056 wrote to memory of 2332 3056 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe svchos.exe PID 3056 wrote to memory of 2332 3056 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe svchos.exe PID 3056 wrote to memory of 2332 3056 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe svchos.exe PID 3056 wrote to memory of 2332 3056 276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe svchos.exe PID 2256 wrote to memory of 2284 2256 TXPlatforn.exe TXPlatforn.exe PID 2256 wrote to memory of 2284 2256 TXPlatforn.exe TXPlatforn.exe PID 2256 wrote to memory of 2284 2256 TXPlatforn.exe TXPlatforn.exe PID 2256 wrote to memory of 2284 2256 TXPlatforn.exe TXPlatforn.exe PID 2256 wrote to memory of 2284 2256 TXPlatforn.exe TXPlatforn.exe PID 2256 wrote to memory of 2284 2256 TXPlatforn.exe TXPlatforn.exe PID 2256 wrote to memory of 2284 2256 TXPlatforn.exe TXPlatforn.exe PID 2292 wrote to memory of 2068 2292 cmd.exe PING.EXE PID 2292 wrote to memory of 2068 2292 cmd.exe PING.EXE PID 2292 wrote to memory of 2068 2292 cmd.exe PING.EXE PID 2292 wrote to memory of 2068 2292 cmd.exe PING.EXE PID 2584 wrote to memory of 2972 2584 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2584 wrote to memory of 2972 2584 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2584 wrote to memory of 2972 2584 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2584 wrote to memory of 2972 2584 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe"C:\Users\Admin\AppData\Local\Temp\276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2332
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵PID:888
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259401972.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5c5cc05e22a7fcad9e87a05a6f7f8527e
SHA1b8f6e5383224ceb99ca9226125a77bf10ca8fa8c
SHA256dbe8d9aeffb7de959bf06de876177c89e723a425644dd48798519808118e4d63
SHA5121e2c905f95429c449b7b5ee62f2d657e4b01b19d3aa0ffe53c1ee4884775318e722d9a74e5fd771080aace28b680697cae9dba75d4a2a883ea08df303992124e
-
Filesize
1.9MB
MD5f40302c74f2d02c4106a8884710dd8c5
SHA140ad5418278de7f9eb99237c47b6d0dd576d98c4
SHA256276744e8314cd637b1680c4a591771f894b36c4072ea0933a3da842083d216b4
SHA51233a0163b5f203cda2c9f58277a7e8dc02d9a4bd50824ff47dcf74dfacac81a125bb1842b8a9c469273ead162512d6fb16de86ab386ae138f78f33079384ed9c7
-
Filesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
Filesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
Filesize
50KB
MD53754dde00e6b8cc6733f30f705c3106f
SHA1cb63f807052c5590acee6f85e4704d663b1dc1f0
SHA256f4ae502167053dc4ba32bc6acd83a93e691a88df5e233f22e25f98e3d5836960
SHA512f618916561286899b9b4d2ede798181a5fdf93b2b063558b6c04c3ce0247be059fc44d638dc5870c1270ffc5eb1313aa1373b2b381c02e09b46719096414a28e
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d