Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 11:04
Static task
static1
Behavioral task
behavioral1
Sample
75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe
Resource
win7-20240508-en
General
-
Target
75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe
-
Size
2.2MB
-
MD5
cfa2d359025337275c9ce6a299956c42
-
SHA1
2580dc360c40b312350c1c6727db4e08ece38c1d
-
SHA256
75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745
-
SHA512
6c13c1b04bce3f276d6050adaf093d0e57b090f8ae3dcd3ff05cffa53d140b9cb4b7242e6795f20d281dbfd58f21220001d66f0aebdae8c91aba209d06b8f8ab
-
SSDEEP
49152:E09XJt4HIN2H2tFvduyS6aDfs89LwQZ5DC6bZvAxFUmatVoPM:pZJt4HINy2Lk6OfswLwQ45sVoE
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2184-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2184-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2616-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2184-21-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2716-34-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2616-33-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2716-35-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2716-38-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2716-73-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2184-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2184-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2616-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2184-21-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2716-34-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2616-33-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2716-35-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2716-38-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2716-73-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
Processes:
RVN.exeTXPlatforn.exeTXPlatforn.exeHD_75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exepid process 2184 RVN.exe 2616 TXPlatforn.exe 2716 TXPlatforn.exe 2284 HD_75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe -
Loads dropped DLL 3 IoCs
Processes:
75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exeTXPlatforn.exepid process 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe 2616 TXPlatforn.exe -
Processes:
resource yara_rule behavioral1/memory/2184-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2184-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2184-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2616-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2184-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2716-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2616-33-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2716-35-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2716-38-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2716-73-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
RVN.exedescription ioc process File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
HD_75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exepid process 2284 HD_75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe -
Drops file in Program Files directory 4 IoCs
Processes:
75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exedescription ioc process File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exepid process 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2716 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RVN.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2184 RVN.exe Token: SeLoadDriverPrivilege 2716 TXPlatforn.exe Token: 33 2716 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2716 TXPlatforn.exe Token: 33 2716 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2716 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exepid process 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exeRVN.exeTXPlatforn.execmd.exedescription pid process target process PID 3068 wrote to memory of 2184 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe RVN.exe PID 3068 wrote to memory of 2184 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe RVN.exe PID 3068 wrote to memory of 2184 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe RVN.exe PID 3068 wrote to memory of 2184 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe RVN.exe PID 3068 wrote to memory of 2184 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe RVN.exe PID 3068 wrote to memory of 2184 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe RVN.exe PID 3068 wrote to memory of 2184 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe RVN.exe PID 2184 wrote to memory of 1276 2184 RVN.exe cmd.exe PID 2184 wrote to memory of 1276 2184 RVN.exe cmd.exe PID 2184 wrote to memory of 1276 2184 RVN.exe cmd.exe PID 2184 wrote to memory of 1276 2184 RVN.exe cmd.exe PID 2616 wrote to memory of 2716 2616 TXPlatforn.exe TXPlatforn.exe PID 2616 wrote to memory of 2716 2616 TXPlatforn.exe TXPlatforn.exe PID 2616 wrote to memory of 2716 2616 TXPlatforn.exe TXPlatforn.exe PID 2616 wrote to memory of 2716 2616 TXPlatforn.exe TXPlatforn.exe PID 2616 wrote to memory of 2716 2616 TXPlatforn.exe TXPlatforn.exe PID 2616 wrote to memory of 2716 2616 TXPlatforn.exe TXPlatforn.exe PID 2616 wrote to memory of 2716 2616 TXPlatforn.exe TXPlatforn.exe PID 3068 wrote to memory of 2284 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe HD_75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe PID 3068 wrote to memory of 2284 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe HD_75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe PID 3068 wrote to memory of 2284 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe HD_75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe PID 3068 wrote to memory of 2284 3068 75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe HD_75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe PID 1276 wrote to memory of 2896 1276 cmd.exe PING.EXE PID 1276 wrote to memory of 2896 1276 cmd.exe PING.EXE PID 1276 wrote to memory of 2896 1276 cmd.exe PING.EXE PID 1276 wrote to memory of 2896 1276 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe"C:\Users\Admin\AppData\Local\Temp\75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\HD_75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exeC:\Users\Admin\AppData\Local\Temp\HD_75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2284
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5188770cae548b3e656b435547b864df0
SHA1e2ce3871bf9b498a97f2af8282319645185faaf0
SHA2560fa124554fa23f5faa2cc009d071a1df1bea8d895da8653e4a9b64b9c09cdee3
SHA512b1848b30a0fae482e9a99d39a25ad5696fb9f09cd8e0a5b101f65e70e4da64b40c4dadc37d977aa70b1ae9825b9a9862eb4ff4bb893e944f4fc0787bbd1f7fb0
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
\Users\Admin\AppData\Local\Temp\HD_75917d64164a26eaca231343dd2c72c736e4571ab13f35c354fc89597f237745.exe
Filesize971KB
MD580b6006855f5c57ba8e05ebb66ffc9c6
SHA1407a7c44c17125ffddc0a10931b7fc2f6222b1cf
SHA25656ec996a49721afe81996aa050a0b6f3029215d77a375699be18d076b99992c3
SHA5124088c74ffb988b7d0f2aa3b299ba4a2b27615c3c26769ea78e42443f97414d0c489bec6382ff2930190957145ab713be7c9825c27b36099e3ab704bed6fef022