Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 10:15
Static task
static1
Behavioral task
behavioral1
Sample
7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe
Resource
win7-20240221-en
General
-
Target
7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe
-
Size
2.3MB
-
MD5
1942fd98387734dfde0557d1a227fc7b
-
SHA1
91bc0820868bd4d7f4e66e48456bbfaba924d530
-
SHA256
7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338
-
SHA512
cc17cdba72bc1ab688a752e3ef24c4a7cf0b9a1cd814fc18ad946450ac85b9355399a7f3c9ac782eae78babbf9fe57ebeec83f63683c503cb060e913ee9356f2
-
SSDEEP
49152:r09XJt4HIN2H2tFvduySSd0YZPItx2apeapelI:YZJt4HINy2LkSd+tUvlI
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2388-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2388-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2388-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4476-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4476-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4476-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4008-28-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4008-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4008-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2388-34-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4476-35-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4008-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/2388-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2388-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2388-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4476-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4476-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4476-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4008-28-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4008-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4008-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2388-34-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4476-35-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4008-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
Processes:
RVN.exeTXPlatforn.exeHD_7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exeTXPlatforn.exepid process 2388 RVN.exe 4476 TXPlatforn.exe 3516 HD_7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe 4008 TXPlatforn.exe -
Processes:
resource yara_rule behavioral2/memory/2388-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2388-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2388-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2388-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4476-14-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4476-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4476-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4476-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4008-28-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4008-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4008-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2388-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4476-35-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4008-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
RVN.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 5 IoCs
Processes:
7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exepid process 3248 7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe 3248 7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 4008 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RVN.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2388 RVN.exe Token: SeLoadDriverPrivilege 4008 TXPlatforn.exe Token: 33 4008 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4008 TXPlatforn.exe Token: 33 4008 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4008 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exepid process 3248 7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe 3248 7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exeRVN.exeTXPlatforn.execmd.exedescription pid process target process PID 3248 wrote to memory of 2388 3248 7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe RVN.exe PID 3248 wrote to memory of 2388 3248 7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe RVN.exe PID 3248 wrote to memory of 2388 3248 7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe RVN.exe PID 2388 wrote to memory of 2892 2388 RVN.exe cmd.exe PID 2388 wrote to memory of 2892 2388 RVN.exe cmd.exe PID 2388 wrote to memory of 2892 2388 RVN.exe cmd.exe PID 4476 wrote to memory of 4008 4476 TXPlatforn.exe TXPlatforn.exe PID 4476 wrote to memory of 4008 4476 TXPlatforn.exe TXPlatforn.exe PID 4476 wrote to memory of 4008 4476 TXPlatforn.exe TXPlatforn.exe PID 2892 wrote to memory of 3712 2892 cmd.exe PING.EXE PID 2892 wrote to memory of 3712 2892 cmd.exe PING.EXE PID 2892 wrote to memory of 3712 2892 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe"C:\Users\Admin\AppData\Local\Temp\7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\HD_7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exeC:\Users\Admin\AppData\Local\Temp\HD_7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_7617256fd1902c5cc524ce3d4683b4b86ef5b68eb548cad61efd85a1ddf8b338.exeFilesize
645KB
MD500eae789b0aab1b0fbd23b830fbf1064
SHA1e4e5fd089f6ae17c83f073cf91edc9db8189980d
SHA2567addb2269266ac471a690802cab54539b40c2ae5b31e2120fdcf8dfb0ed15dc7
SHA51223a0e06b39f8b5a932ae5b8f60704ba265332b341ac8bab5b74b2f31f04ce8c7fe6f77278d70c7685cfa894ab0e25a70d89990f5f643b54c07337f90fa5943fb
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.7MB
MD536d6e7690dc3cc2f0c3907f3adc9af62
SHA1c0c6b1b325d28f47f4fe83e8fc0a34baee5feb2d
SHA256f3674bd4d06d3896ad609c73acd42b7ab9b64a86ce6054c10d81acfe8966606f
SHA51218fffc225437bc4bdc33e234902aa062a1aab700c84ef0ccd77ad6ee84580ddcac8b86d273105837b876077f30f5fb7625d02d98306413edc575e4f5c6ddb5e4
-
C:\Users\Admin\AppData\Local\Temp\RCXC91C.tmpFilesize
1.4MB
MD5671bd6671cb7601ad8854cd0aaa614be
SHA1179dc3a7dfebb0a79bda784b3a7dbda500a62265
SHA256819a20d2f1a20679bd685006b6b8a867ff4f6a135558c23780c5ac0842d7836c
SHA512d028d3284305d8fbb03d2d126c5945d42fa0aea53b1e6616108cf5a21798bd7bef867963c7cedfc2c47927c9fae6c900bcbc3cc960dcd839762f02355289680a
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeFilesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
C:\Users\Admin\AppData\Local\Temp\X.icoFilesize
69KB
MD5e33fb6d686b1a8b171349572c5a33f67
SHA129f24fe536adf799b69b63c83efadc1bce457a54
SHA256020c8e0963f89f4b14538b7d69e83c6fec44a29bbbd52fbb6deb2be5c697f450
SHA512cf1f1d6a9efe53f84e5b4a8246b87c0b96496716605d1b00352d9aae30e664d3d2cbadebf598b4e690a9feef0b5785887a4e643cc5f68938ca744af1d3539e55
-
memory/2388-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2388-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2388-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2388-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2388-34-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4008-32-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4008-29-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4008-28-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4008-36-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4476-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4476-35-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4476-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4476-19-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4476-14-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB