Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 09:07
Static task
static1
Behavioral task
behavioral1
Sample
b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe
Resource
win7-20240221-en
General
-
Target
b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe
-
Size
3.6MB
-
MD5
416ff66c1dc67324b25190d1fa3159f6
-
SHA1
cfba24c89e3b072ef8a8648f5a3aeff6a17a47c1
-
SHA256
b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3
-
SHA512
34dd8e4971550a045de8cbcba4ade580d618b9f65030e602f67ba8177c275503e60d6fee01593c35bf307f4f43203e6abc59c8f78551502c1f6f816aaadbd8ab
-
SSDEEP
49152:t09XJt4HIN2H2tFvduySMgWW1Dmn2X5+0vY3u6c20LAonnHeJ9EWWB:OZJt4HINy2LkQW1Dmn2Xk0vjAoHe9WB
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2676-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2676-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2676-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2600-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2600-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2600-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2124-23-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2124-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2124-35-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2124-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2600-26-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/2676-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2676-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2676-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2600-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2600-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2600-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2124-23-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2124-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2124-35-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2124-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2600-26-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
Processes:
RVN.exeTXPlatforn.exeTXPlatforn.exeHD_b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exepid process 2676 RVN.exe 2600 TXPlatforn.exe 2124 TXPlatforn.exe 1580 HD_b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe -
Processes:
resource yara_rule behavioral2/memory/2676-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2676-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2676-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2676-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2600-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2600-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2600-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2600-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2124-23-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2124-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2124-35-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2124-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2600-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
RVN.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 5 IoCs
Processes:
b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exepid process 4336 b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe 4336 b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2124 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RVN.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2676 RVN.exe Token: SeLoadDriverPrivilege 2124 TXPlatforn.exe Token: 33 2124 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2124 TXPlatforn.exe Token: 33 2124 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2124 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exepid process 4336 b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe 4336 b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exeTXPlatforn.exeRVN.execmd.exedescription pid process target process PID 4336 wrote to memory of 2676 4336 b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe RVN.exe PID 4336 wrote to memory of 2676 4336 b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe RVN.exe PID 4336 wrote to memory of 2676 4336 b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe RVN.exe PID 2600 wrote to memory of 2124 2600 TXPlatforn.exe TXPlatforn.exe PID 2600 wrote to memory of 2124 2600 TXPlatforn.exe TXPlatforn.exe PID 2600 wrote to memory of 2124 2600 TXPlatforn.exe TXPlatforn.exe PID 2676 wrote to memory of 2524 2676 RVN.exe cmd.exe PID 2676 wrote to memory of 2524 2676 RVN.exe cmd.exe PID 2676 wrote to memory of 2524 2676 RVN.exe cmd.exe PID 4336 wrote to memory of 1580 4336 b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe HD_b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe PID 4336 wrote to memory of 1580 4336 b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe HD_b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe PID 2524 wrote to memory of 3164 2524 cmd.exe PING.EXE PID 2524 wrote to memory of 3164 2524 cmd.exe PING.EXE PID 2524 wrote to memory of 3164 2524 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe"C:\Users\Admin\AppData\Local\Temp\b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\HD_b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exeC:\Users\Admin\AppData\Local\Temp\HD_b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe2⤵
- Executes dropped EXE
PID:1580
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4088,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:81⤵PID:5060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD52138e35c80242050be3fb7110c0ebce7
SHA1c5993393cdc58b2da20039503c7e048b50e066ae
SHA256e4960ce1c3c7d1b948b684e607e1b4cd3665d8920702bbcd6f1c175adef3001c
SHA5121f414fb624f14881513a7a2659d04d127ad01876f16fd82d73e9de7457204be72a03ad9c025dd5709aec561975b03991eb03357d436c7aa2c2b2b2655301a75c
-
C:\Users\Admin\AppData\Local\Temp\HD_b759eda4a2f54df366c57b2e7334474bacc7f74ceceea1dfa6438e40d80efdf3.exe
Filesize2.1MB
MD59bcea9023e06d18fec2f77abff9bcd23
SHA12e9937861dc8c9de4715ba9afd787c6a2e662ab3
SHA2569d81011233bbe5e668ed2d55e4e4d0b8f5ad7aafa23c88ce5757f3c9585f79f2
SHA5126c05950f6fb4be87d5b07e30d30760583881ef1d2888ef97d00696b961b14ec80c421cdf26ebbd9e45d6a95f7e91c37714bd8168f257f8808a3f716ed61a15ae
-
Filesize
1.5MB
MD5c04cb7a39899137aa149ae8ac7c615e9
SHA199bf76ef53e6cd9d42edc7513d001e195e23e477
SHA2567656312ace7936c96eee451a0f142eca1651711f2dd5276bd5a0a12696dee38f
SHA5128551a76cced20658bbe4a932522de7b19e2e0feb7c62011d851ade208759bf4470d58b5ad5dc66029fba96d3e32be84573504b0fc8cedc37b8f9e4cf58060533
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
Filesize
69KB
MD5e33fb6d686b1a8b171349572c5a33f67
SHA129f24fe536adf799b69b63c83efadc1bce457a54
SHA256020c8e0963f89f4b14538b7d69e83c6fec44a29bbbd52fbb6deb2be5c697f450
SHA512cf1f1d6a9efe53f84e5b4a8246b87c0b96496716605d1b00352d9aae30e664d3d2cbadebf598b4e690a9feef0b5785887a4e643cc5f68938ca744af1d3539e55