gh0strat | 9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe
Size 4.0MB
Sample240529-dat68sfe6z
SHA256 9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7
MD5 7743bba6cfb7dcf82717f58a5c8ee6d5
SHA1 16618c8210a37be3575a34f04803e83c346cba48
SHA512 4f99608fa3d12704d0018b043f7c91c903500c58302cfd83dbdcd28c1dee4050ac4ed28f24f02e2d70054f52f3c39fbd77aaad721eebd59152dafe6e4f68c2a3
SSDEEP 98304:9ZJt4HINy2Lk+ip46cXdVpVpmby+r2Ohkgkh:viINy2Lk1hQA28VS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 10 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/3064-6-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3064-10-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3064-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2568-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2568-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2568-24-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2568-17-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4836-33-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4836-29-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4836-34-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 11 IoCs

resource	yara_rule
behavioral2/memory/3064-6-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3064-10-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3064-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2568-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2568-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2568-24-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4836-25-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2568-17-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4836-33-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4836-29-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4836-34-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	HD_9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe

Executes dropped EXE 4 IoCs

pid	Process
3064	RVN.exe
2568	TXPlatforn.exe
4836	TXPlatforn.exe
2796	HD_9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3064-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3064-4-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3064-10-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3064-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2568-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2568-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2568-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2568-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4836-25-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2568-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4836-33-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4836-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4836-34-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31109490"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3576135432"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423715915"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004f8caa1c9f4cba428e26b677a31a634000000000020000000000106600000001000020000000e830df53bdf525e983f6a4515829451a83b51cacc00845ef0886a0dcf052851b000000000e80000000020000200000004e84947983fe3b36a834ca4c3c4a39db60ecaed2f2a1498c85d903d5e0c1f9662000000025093fc73985777b0263e48bbe98db19e0d8d29492aef5cc49a1c68f93e8958c400000006ae0bb8cea0b1089eca8ca84d040b897da06f36dc67dc74faf1040359c989dc98a842283a7a588fa80f43ea03be44d66ef35abd92e8cf84726bb560696df861c	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90979cea72b1da01	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004f8caa1c9f4cba428e26b677a31a634000000000020000000000106600000001000020000000971ae8c67e52eab5e2dabdc75640fce69470df219d86ffcedf72b453718fc3b5000000000e8000000002000020000000e327094be0bcd77e6749d6b0b360bab01957446c99fa9c15ba82983172f8460f2000000011e50cfb635bcd31d17f25792a572d88a012a6ded606e09e1557fc982da27819400000007110a0156ea7cd38ddf775c615e378b37a4c0ecbd0117b447384f0ce4f3c50f940079b60671aeb729a80c61645cf8f8520900859697131792c8fd1b96b65b9bb	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3575197669"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3576135432"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3575197669"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31109490"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{009EF33B-1D66-11EF-A2D1-6A665EE13EB6} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 700da6ea72b1da01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31109490"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31109490"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
548	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4580	9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe
4580	9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4836	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3064	RVN.exe
Token: SeLoadDriverPrivilege	4836	TXPlatforn.exe
Token: 33	4836	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	4836	TXPlatforn.exe
Token: 33	4836	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	4836	TXPlatforn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
404	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4580	9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe
4580	9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe
404	IEXPLORE.EXE
404	IEXPLORE.EXE
4668	IEXPLORE.EXE
4668	IEXPLORE.EXE
4668	IEXPLORE.EXE
4668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 3064	4580	9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe	82
PID 4580 wrote to memory of 3064	4580	9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe	82
PID 4580 wrote to memory of 3064	4580	9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe	82
PID 3064 wrote to memory of 3628	3064	RVN.exe	84
PID 3064 wrote to memory of 3628	3064	RVN.exe	84
PID 3064 wrote to memory of 3628	3064	RVN.exe	84
PID 2568 wrote to memory of 4836	2568	TXPlatforn.exe	85
PID 2568 wrote to memory of 4836	2568	TXPlatforn.exe	85
PID 2568 wrote to memory of 4836	2568	TXPlatforn.exe	85
PID 4580 wrote to memory of 2796	4580	9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe	86
PID 4580 wrote to memory of 2796	4580	9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe	86
PID 4580 wrote to memory of 2796	4580	9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe	86
PID 3628 wrote to memory of 548	3628	cmd.exe	88
PID 3628 wrote to memory of 548	3628	cmd.exe	88
PID 3628 wrote to memory of 548	3628	cmd.exe	88
PID 2796 wrote to memory of 4984	2796	HD_9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe	97
PID 2796 wrote to memory of 4984	2796	HD_9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe	97
PID 2796 wrote to memory of 4984	2796	HD_9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe	97
PID 4984 wrote to memory of 404	4984	iexplore.exe	98
PID 4984 wrote to memory of 404	4984	iexplore.exe	98
PID 404 wrote to memory of 4668	404	IEXPLORE.EXE	99
PID 404 wrote to memory of 4668	404	IEXPLORE.EXE	99
PID 404 wrote to memory of 4668	404	IEXPLORE.EXE	99

C:\Users\Admin\AppData\Local\Temp\9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe
"C:\Users\Admin\AppData\Local\Temp\9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Local\Temp\RVN.exe
  C:\Users\Admin\AppData\Local\Temp\\RVN.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3628
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:548
- C:\Users\Admin\AppData\Local\Temp\HD_9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe
  C:\Users\Admin\AppData\Local\Temp\HD_9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://se.360.cn/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://se.360.cn/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:404
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:404 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4668

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 471B
SHA256 3839653c6cf51672c67c89c5b565c5474aa031c98746cd89c5763995a61b3d30
MD5 c04af526ef1338b7a95090a096fb836f
SHA1 9872580735c19384b9eab5baf168e288862dd8aa
SHA512 46c4c9d951074ff2fdda76283306e5ae12fe1829bb24ec8ed827785ff1967075c5da6cd21b447adf69e2af663b38cab5a478e54213f46e84a7f329c1eeebe40d
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 404B
SHA256 918dc4f13c4313a0d4442748882123bfd2cd8564963591ee68fbd7f03e39e210
MD5 f1e2bc053118dd9c05cf5d2335f6d200
SHA1 8e8437caa3489873b4785b18c6fc64b2cc0239ec
SHA512 1a4fa584cf16e5a2e30159118165b59df595647951d8c6ee0fec0ed72fab6e12182ef0b201b24aed4854e9eb2b28a8c98f9aace022071cf1769313e257a2bcf9
MD5 SHA1 SHA512

Submit Download

verC1E8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verC1E8.tmp
Size 15KB
SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
MD5 1a545d0052b581fbb2ab4c52133846bc
SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
MD5 SHA1 SHA512 SSDEEP

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z5ILU938\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_9a905cbf6c7657cfbad7a8f59e9643d9b368c486801a70cc6c06c87184e381c7.exe
Size 2.8MB
SHA256 1ab0fdf2d3c814acfd991054a001c4a19dc2fb1605e706a27f531cb32c79a6cb
MD5 acafd63654acc5f3799fbeb8f73d6b16
SHA1 1d4402e6a26a06779a35a2362d186ebca951b1b1
SHA512 e127508b1f300d6499a9200a87c6a9e6bb2a6a174d05b84485d446663186562e6ff4eb3c827acf59bcd2d095d9889b6e4ddd8b5e41dd7a20d78d04ee06b79ed2
SSDEEP 49152:e3fHrF6GZ2CS0R360yt46cXdhTpQepmvTylJ6P8r42/rTmJ7kgkhN0:oip46cXdVpVpmby+r2Ohkgkh
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.2MB
SHA256 2458a07a425b2129985ad1f44d3c8f89a20ee237b47ae6b569a49dec48241bff
MD5 55de90887452d29933661ea4386b7801
SHA1 374e75e5f3ffbae4fcb50a433aa93dc7e0268f06
SHA512 227dcfe33eefb85166c421a4593e4aa13a3d5a633de82dbe8238a447fb75c9ff05b5de4500d76c6a264dff0798e0b619da6475322f4a4adb67519baaf20c4ed3
SSDEEP 24576:Y09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+IFPkYXA4:Y09XJt4HIN2H2tFvduySOh1H
MD5 SHA1 SHA512 SSDEEP

Submit Download

RVN.exe

Path C:\Users\Admin\AppData\Local\Temp\RVN.exe
Size 377KB
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
SSDEEP 6144:BEo7J1ixs4uVKE9rFEAHKThrBSq2hAzSM5mDo9lSJULHZqExlD2E1LxhJVwIe0Dy:Wo2HQVWAHkFSq2hAWJYlMUtrxlyuJVRq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2568-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2568-24-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2568-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2568-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2568-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3064-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3064-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3064-4-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3064-10-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4836-25-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4836-34-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4836-29-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4836-33-0x0000000010000000-0x00000000101B6000-memory.dmp

Download