Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 06:23
Static task
static1
Behavioral task
behavioral1
Sample
7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe
Resource
win7-20240508-en
General
-
Target
7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe
-
Size
2.1MB
-
MD5
7413de8b6177b98d038a22ec3a0c2070
-
SHA1
eaeec0aced9f01848ab08ec6d9ab36b1f69e8aa7
-
SHA256
7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2
-
SHA512
139cc0298c9f7eb7732d5a4f39f9caaa7a1bbbe9cc181656f95312f4535e932ef104a2f3d3aa66307f564463eec367c874543546eedb8ac521141af421791187
-
SSDEEP
49152:aQZAdVyVT9n/Gg0P+WhowDmn2aQwMHM87fioKBV:DGdVyVT9nOgmh/Dmn2aPz87a3
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3172-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3172-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3172-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4784-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4784-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4784-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4576-24-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4784-86-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4576-87-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4576-91-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4576-92-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/3172-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3172-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3172-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4784-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4784-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4784-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat C:\Windows\SysWOW64\240606265.txt family_gh0strat behavioral2/memory/4576-24-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4784-86-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4576-87-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4576-91-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4576-92-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240606265.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
Processes:
svchost.exeTXPlatforn.exeTXPlatforn.exesvchos.exeHD_7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 3172 svchost.exe 4784 TXPlatforn.exe 4576 TXPlatforn.exe 2000 svchos.exe 3160 HD_7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe 3480 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 3 IoCs
Processes:
svchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2000 svchos.exe 4420 svchost.exe 3480 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral2/memory/3172-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3172-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3172-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3172-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4784-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4784-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4784-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4576-24-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4784-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4784-86-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4576-87-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4576-91-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4576-92-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchost.exesvchos.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\240606265.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe -
Drops file in Program Files directory 5 IoCs
Processes:
7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exepid process 3984 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe 3984 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 4576 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 3172 svchost.exe Token: SeLoadDriverPrivilege 4576 TXPlatforn.exe Token: 33 4576 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4576 TXPlatforn.exe Token: 33 4576 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4576 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exepid process 3984 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe 3984 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exesvchost.exeTXPlatforn.execmd.exesvchost.exedescription pid process target process PID 3984 wrote to memory of 3172 3984 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe svchost.exe PID 3984 wrote to memory of 3172 3984 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe svchost.exe PID 3984 wrote to memory of 3172 3984 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe svchost.exe PID 3172 wrote to memory of 5064 3172 svchost.exe cmd.exe PID 3172 wrote to memory of 5064 3172 svchost.exe cmd.exe PID 3172 wrote to memory of 5064 3172 svchost.exe cmd.exe PID 4784 wrote to memory of 4576 4784 TXPlatforn.exe TXPlatforn.exe PID 4784 wrote to memory of 4576 4784 TXPlatforn.exe TXPlatforn.exe PID 4784 wrote to memory of 4576 4784 TXPlatforn.exe TXPlatforn.exe PID 3984 wrote to memory of 2000 3984 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe svchos.exe PID 3984 wrote to memory of 2000 3984 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe svchos.exe PID 3984 wrote to memory of 2000 3984 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe svchos.exe PID 3984 wrote to memory of 3160 3984 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe HD_7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe PID 3984 wrote to memory of 3160 3984 7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe HD_7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe PID 5064 wrote to memory of 3856 5064 cmd.exe PING.EXE PID 5064 wrote to memory of 3856 5064 cmd.exe PING.EXE PID 5064 wrote to memory of 3856 5064 cmd.exe PING.EXE PID 4420 wrote to memory of 3480 4420 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 4420 wrote to memory of 3480 4420 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 4420 wrote to memory of 3480 4420 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe"C:\Users\Admin\AppData\Local\Temp\7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\HD_7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exeC:\Users\Admin\AppData\Local\Temp\HD_7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exe2⤵
- Executes dropped EXE
PID:3160
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵PID:1952
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240606265.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_7fdb57fce442956636724749454ee378d7ef9f3feffe095fdd0843231fc47ac2.exeFilesize
621KB
MD541ee948ba0b50a6a4d1fa9a383e552fa
SHA1ce37a90bb4db95f885b7eaa3d7a2f08373f45245
SHA256be898f77a4d55fd08ad5e3554769d7fbd55aa0b52f1a854d3114ca464888a9e4
SHA512bdb0d72752c67967ec6fe3440fb26773d9e17f9f9f277525716dafdeadb636f9e4850cf5c0c7aee61ad38c3082d6a3e99c8f7001a02a6f4b218db57bb9bc11ed
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.5MB
MD56fb3eca744407e3537ace939b87e4d5b
SHA193b107c9e3d8b04f3838596bf7123bd9738e1006
SHA256a395ce248735af4e3348764064e8643a531295ad1fec676187f4ecf9e2384014
SHA512ade32aaf737d6b3b1976ae5b9e5cc92b8b266c0df42168563de1666624d59bc9c9b9502f08ef231d432c28ca24129544a629d10eac026eb8eb86b9dec8076345
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
C:\Windows\SysWOW64\240606265.txtFilesize
50KB
MD569c2c6e78270074f3508352bd224d408
SHA118924516afd61e1f50f0557fc98f6110dbe643cc
SHA25682fc67a74524b6e3eb622b06063a8b7903134adbeb63d3eaec8a43dd7dc5da4b
SHA5120e1dfd72f78fbd93c687b6a29048868333a298d77275009c601ba65e0395b90966a1d04a118627ba7931607a8fb7cb3fc9e65a6d39fd7777c855c9f950a2e4e9
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
memory/3172-10-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3172-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3172-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3172-5-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4576-24-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4576-87-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4576-91-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4576-92-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4784-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4784-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4784-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4784-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4784-86-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB