Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 08:34
Static task
static1
Behavioral task
behavioral1
Sample
b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe
Resource
win7-20240220-en
General
-
Target
b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe
-
Size
2.9MB
-
MD5
fb9a3095c8c0e60fe211504f91687357
-
SHA1
4f2f99ed16fbf25afb8883cb30b472d4341c2fd9
-
SHA256
b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135
-
SHA512
8ae90225a7b8a400711071ad3a864797e4fef042f1f15294000950f5a9e0a2bf723783415923044e25d0cda99e8884560d3e5433f28670ea85c2bce57e1540da
-
SSDEEP
49152:J09XJt4HIN2H2tFvduyS7Ydq5368ic36vPxeXGnNAoxrcYz9IF7m498+YJC9yCT2:qZJt4HINy2Lk7yf8ic36v4XkVxrcYz9N
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2968-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2968-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2968-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2364-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2364-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2364-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2364-25-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3944-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3944-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3944-34-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3944-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/2968-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2968-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2968-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2364-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2364-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2364-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2364-25-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3944-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3944-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3944-34-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3944-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
Processes:
RVN.exeTXPlatforn.exeHD_b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exeTXPlatforn.exepid process 2968 RVN.exe 2364 TXPlatforn.exe 1380 HD_b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe 3944 TXPlatforn.exe -
Processes:
resource yara_rule behavioral2/memory/2968-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2968-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2968-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2968-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2364-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2364-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2364-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2364-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2364-25-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3944-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3944-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3944-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3944-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
RVN.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 5 IoCs
Processes:
b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exepid process 3400 b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe 3400 b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 3944 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RVN.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2968 RVN.exe Token: SeLoadDriverPrivilege 3944 TXPlatforn.exe Token: 33 3944 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 3944 TXPlatforn.exe Token: 33 3944 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 3944 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exepid process 3400 b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe 3400 b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exeRVN.execmd.exeTXPlatforn.exedescription pid process target process PID 3400 wrote to memory of 2968 3400 b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe RVN.exe PID 3400 wrote to memory of 2968 3400 b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe RVN.exe PID 3400 wrote to memory of 2968 3400 b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe RVN.exe PID 2968 wrote to memory of 3340 2968 RVN.exe cmd.exe PID 2968 wrote to memory of 3340 2968 RVN.exe cmd.exe PID 2968 wrote to memory of 3340 2968 RVN.exe cmd.exe PID 3340 wrote to memory of 4952 3340 cmd.exe PING.EXE PID 3340 wrote to memory of 4952 3340 cmd.exe PING.EXE PID 3340 wrote to memory of 4952 3340 cmd.exe PING.EXE PID 3400 wrote to memory of 1380 3400 b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe HD_b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe PID 3400 wrote to memory of 1380 3400 b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe HD_b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe PID 3400 wrote to memory of 1380 3400 b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe HD_b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe PID 2364 wrote to memory of 3944 2364 TXPlatforn.exe TXPlatforn.exe PID 2364 wrote to memory of 3944 2364 TXPlatforn.exe TXPlatforn.exe PID 2364 wrote to memory of 3944 2364 TXPlatforn.exe TXPlatforn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe"C:\Users\Admin\AppData\Local\Temp\b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\HD_b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exeC:\Users\Admin\AppData\Local\Temp\HD_b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3916 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.3MB
MD508404afce33fb3f15b8f900ffb9b7b1c
SHA1ada90bfaee16a7282420704b1a99fcfa21392404
SHA256b8e2ed59bcf1299ac6417570b583a4dd9f6a9dbae56462e9c263ea97f8717643
SHA512c9aa66b8e7244cb2a0aac8632d58ab0441180fe3ac15b7bc8279858d6ad0c04b32c270d9c675a55e2f5bbc13ecaec5fdfc79518cf9af8fbda9d9982e68f4a617
-
C:\Users\Admin\AppData\Local\Temp\HD_b09e9f7fb63b79134d6f42bc4886fa7ef2ca1ecfcffb1a07e2a2a39e9cba8135.exeFilesize
1.6MB
MD58c56774d965fee1c2a545f829397f886
SHA1ad6296e781dc51f8b83482f348bde9cbedc5ff1c
SHA2564d4346e5c731db7c49f99f2c161e71217d0db706e878c8de39bef69c40f1c7c3
SHA512af731335ac62f62beef835ae67538b7a3e0bd9313e28e3d758ffc237a2037d48e8f1586f5140a260914dc0716d8f434a104804ec5a57ccd8235ccba663b79032
-
C:\Users\Admin\AppData\Local\Temp\RCXAC4D.tmpFilesize
1.2MB
MD5d6492b201890241296ca5af79f27c269
SHA1a09dd998793a50b52781c22008f31cf54b9b0deb
SHA2560942cfb890ddf36b05ddbe7bbfa440501a8e81c7c7c3107287e07f97a081bdc6
SHA512eab03990d584efbdd1385efe32354d9027c8bdd3a3a4d85d24b04171792d7cba14be2ff863e802c585e1a2a8d78e3a63232ed53250cfe98e6b1b864d7b0b0ef5
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeFilesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
C:\Users\Admin\AppData\Local\Temp\X.icoFilesize
69KB
MD5e33fb6d686b1a8b171349572c5a33f67
SHA129f24fe536adf799b69b63c83efadc1bce457a54
SHA256020c8e0963f89f4b14538b7d69e83c6fec44a29bbbd52fbb6deb2be5c697f450
SHA512cf1f1d6a9efe53f84e5b4a8246b87c0b96496716605d1b00352d9aae30e664d3d2cbadebf598b4e690a9feef0b5785887a4e643cc5f68938ca744af1d3539e55
-
memory/2364-25-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2364-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2364-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2364-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2364-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2968-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2968-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2968-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2968-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3944-29-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3944-31-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3944-34-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3944-36-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB