Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 06:46
Static task
static1
Behavioral task
behavioral1
Sample
ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe
Resource
win7-20240419-en
General
-
Target
ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe
-
Size
2.6MB
-
MD5
b4553e0afe7e7d7ece186cd54c7ca513
-
SHA1
a3da175d1977924b017e35a14ffbdbb253011822
-
SHA256
ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31
-
SHA512
1e36a323f0ac40f6769578b4eb66eb505b80306d973d0cdffdd644db5b10871c36ee8413ef88e684cdb0f898f2dca01f4a440d67a1a9cb146e6a1a1e48712337
-
SSDEEP
49152:L09XJt4HIN2H2tFvduySIwypXTrcU0V2mkjSPfRpFmPgHvjD:4ZJt4HINy2LkyXv0PfRpFmUn
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1008-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1008-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1008-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/3000-21-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/3000-30-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2216-46-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2216-70-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2216-72-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1008-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1008-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1008-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/3000-21-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/3000-30-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2216-46-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2216-70-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2216-72-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
Processes:
RVN.exeTXPlatforn.exeHD_ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exeTXPlatforn.exepid process 1008 RVN.exe 3000 TXPlatforn.exe 2748 HD_ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe 2216 TXPlatforn.exe -
Loads dropped DLL 3 IoCs
Processes:
ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exeTXPlatforn.exepid process 1736 ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe 1736 ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe 3000 TXPlatforn.exe -
Processes:
resource yara_rule behavioral1/memory/1008-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1008-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1008-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1008-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/3000-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/3000-30-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2216-46-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2216-70-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2216-72-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
RVN.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 4 IoCs
Processes:
ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exepid process 1736 ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2216 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RVN.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 1008 RVN.exe Token: SeLoadDriverPrivilege 2216 TXPlatforn.exe Token: 33 2216 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2216 TXPlatforn.exe Token: 33 2216 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2216 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exepid process 1736 ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe 1736 ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exeRVN.exeTXPlatforn.execmd.exedescription pid process target process PID 1736 wrote to memory of 1008 1736 ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe RVN.exe PID 1736 wrote to memory of 1008 1736 ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe RVN.exe PID 1736 wrote to memory of 1008 1736 ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe RVN.exe PID 1736 wrote to memory of 1008 1736 ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe RVN.exe PID 1736 wrote to memory of 1008 1736 ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe RVN.exe PID 1736 wrote to memory of 1008 1736 ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe RVN.exe PID 1736 wrote to memory of 1008 1736 ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe RVN.exe PID 1008 wrote to memory of 1636 1008 RVN.exe cmd.exe PID 1008 wrote to memory of 1636 1008 RVN.exe cmd.exe PID 1008 wrote to memory of 1636 1008 RVN.exe cmd.exe PID 1008 wrote to memory of 1636 1008 RVN.exe cmd.exe PID 3000 wrote to memory of 2216 3000 TXPlatforn.exe TXPlatforn.exe PID 3000 wrote to memory of 2216 3000 TXPlatforn.exe TXPlatforn.exe PID 3000 wrote to memory of 2216 3000 TXPlatforn.exe TXPlatforn.exe PID 3000 wrote to memory of 2216 3000 TXPlatforn.exe TXPlatforn.exe PID 3000 wrote to memory of 2216 3000 TXPlatforn.exe TXPlatforn.exe PID 3000 wrote to memory of 2216 3000 TXPlatforn.exe TXPlatforn.exe PID 3000 wrote to memory of 2216 3000 TXPlatforn.exe TXPlatforn.exe PID 1636 wrote to memory of 2452 1636 cmd.exe PING.EXE PID 1636 wrote to memory of 2452 1636 cmd.exe PING.EXE PID 1636 wrote to memory of 2452 1636 cmd.exe PING.EXE PID 1636 wrote to memory of 2452 1636 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe"C:\Users\Admin\AppData\Local\Temp\ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\HD_ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exeC:\Users\Admin\AppData\Local\Temp\HD_ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe2⤵
- Executes dropped EXE
PID:2748
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5048ba969fb775639da1c2ffcf070cb57
SHA178dcd6d1a524d982179e5a29c74d45e29b8870b5
SHA256a21812cae7935266b2456df2a504151492dafae9261f10204fc6e925ed5f6cd1
SHA5126c64dde768ce138084d31449cdd4c6554a796d92dda38a4d03e2d0faca6f362cc27706f6d8107d9c5a186ee8de1f66a25e09095fc2a9252281b3bee9e33378b2
-
C:\Users\Admin\AppData\Local\Temp\HD_ad8c2f6379ef461b2e6b21bfa1a2d5ef3b5dde27ac85ad95249a1396c5bceb31.exe
Filesize1.4MB
MD5958180c3bedd3acde34fa4389644e849
SHA1915774d512835543a474dd407d2b85480abc2771
SHA256010ce7fbebd9c606691ff17cd970945df9a7aec7a5ad42da40c0325e6e33a749
SHA5129e8a6117631aaa5201eee9f8a9ae8dc4cd2eb9c7798a4005ccd67714c32426ed62de16c00363e2e6ce5cfcd1cc22ea82c6e811e6db894a3b831e2a47f58a3234
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4