Malware Analysis Report

2024-09-22 15:23

Sample ID 240606-d2776sge74
Target 2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11
SHA256 2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11
Tags
gh0strat purplefox persistence rat rootkit trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11

Threat Level: Known bad

The file 2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11 was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox persistence rat rootkit trojan upx

Detect PurpleFox Rootkit

Gh0strat

Gh0st RAT payload

PurpleFox

Sets service image path in registry

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

UPX packed file

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Runs ping.exe

Suspicious use of WriteProcessMemory

Suspicious behavior: LoadsDriver

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-06 03:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-06 03:31

Reported

2024-06-06 03:51

Platform

win7-20240221-en

Max time kernel

152s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe N/A

Enumerates physical storage devices

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1052 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1052 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1052 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1052 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1052 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1052 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1052 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2104 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2936 wrote to memory of 2744 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2936 wrote to memory of 2744 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2936 wrote to memory of 2744 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2936 wrote to memory of 2744 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2936 wrote to memory of 2744 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2936 wrote to memory of 2744 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2936 wrote to memory of 2744 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1052 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe
PID 1052 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe
PID 1052 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe
PID 1052 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe
PID 2620 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2620 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2620 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2620 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe

"C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe

C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 note.youdao.com udp
US 163.181.154.231:443 note.youdao.com tcp

Files

\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/2104-12-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2104-8-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2104-5-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2104-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2744-26-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2744-30-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2744-37-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2936-27-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe

MD5 d328eb50a4edcb16e12094b420351baa
SHA1 a01f97bbbd8fc521066c02d7241ab5f7ad84f4de
SHA256 8d7e25778e0d6b645c5e4aaf3a97384819038198e79aa19ec5923bfe7295f7de
SHA512 44ad7b6a56c75cf2203e2015cdad66699977c947c14c2f66c2ee86a71056085dc44d2b6073a73b4ebcc2df29b742a54f95f6a367dbb2a5aef56bc2e21f12e439

\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe

MD5 d77a29da8649e76ac5f68db0071ef107
SHA1 e32eb09902e066a4c09d13d79889c5eec19b3a8a
SHA256 1c16e9505a469ff74d69be1e3d901639aad1f150582e061cfcf770fbe3f26f68
SHA512 1768b58756c0a40fbb0fa0107363f819ee78cebb828fc217dc84b3185fa967a15e4aaeb64d465a483f102c6e9e56a74b86203cd0e49f09a122390978ea44f51d

memory/2936-18-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2744-40-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 53e750af94dfe82a8fd222ad4058f5ce
SHA1 bb78f57dd4a23fad328a1283f2ed26b6306a9cef
SHA256 fbfaac6dc6e27820dbed30248f8c9ddf775a330e67858c18e38e84ae29f319ca
SHA512 6315336707ecdcfadea63a4cf042e8cb526dbe12aaa4c2db8bd3a071966230c23514c1ab9723a7be7b5a87454c482cc4cf2186e9de2905d46ad21c6023d87607

memory/2624-103-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/2624-101-0x00000000002E0000-0x00000000002E1000-memory.dmp

memory/2624-113-0x0000000000300000-0x0000000000301000-memory.dmp

memory/2624-111-0x0000000000300000-0x0000000000301000-memory.dmp

memory/2624-109-0x0000000000300000-0x0000000000301000-memory.dmp

memory/2624-108-0x00000000002F0000-0x00000000002F1000-memory.dmp

memory/2624-106-0x00000000002F0000-0x00000000002F1000-memory.dmp

memory/2624-104-0x00000000002F0000-0x00000000002F1000-memory.dmp

memory/2624-98-0x00000000002D0000-0x00000000002D1000-memory.dmp

memory/2624-96-0x00000000002D0000-0x00000000002D1000-memory.dmp

memory/2624-114-0x0000000000400000-0x0000000002A98000-memory.dmp

memory/2624-93-0x00000000002C0000-0x00000000002C1000-memory.dmp

memory/2624-117-0x0000000010000000-0x0000000010009000-memory.dmp

memory/2624-91-0x00000000002C0000-0x00000000002C1000-memory.dmp

memory/2624-88-0x00000000002B0000-0x00000000002B1000-memory.dmp

memory/2624-86-0x00000000002B0000-0x00000000002B1000-memory.dmp

memory/2624-83-0x00000000002A0000-0x00000000002A1000-memory.dmp

memory/2624-81-0x00000000002A0000-0x00000000002A1000-memory.dmp

memory/2624-79-0x00000000002A0000-0x00000000002A1000-memory.dmp

memory/2624-78-0x0000000000290000-0x0000000000291000-memory.dmp

memory/2624-76-0x0000000000290000-0x0000000000291000-memory.dmp

memory/2624-74-0x0000000000290000-0x0000000000291000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-06 03:31

Reported

2024-06-06 03:51

Platform

win10v2004-20240226-en

Max time kernel

135s

Max time network

168s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4908 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 4908 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 4908 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 1804 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 1804 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 1804 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 4724 wrote to memory of 1176 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 4724 wrote to memory of 1176 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 4724 wrote to memory of 1176 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 4908 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe
PID 4908 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe
PID 4908 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe
PID 932 wrote to memory of 940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 932 wrote to memory of 940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 932 wrote to memory of 940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe

"C:\Users\Admin\AppData\Local\Temp\2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe

C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4252 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 note.youdao.com udp
US 163.181.154.232:443 note.youdao.com tcp
US 8.8.8.8:53 232.154.181.163.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 30.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp

Files

C:\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/1804-6-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1804-4-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1804-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1804-8-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4724-17-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4724-16-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1804-20-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4724-15-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/4724-22-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1176-28-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1176-27-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe

MD5 91546d79e9671136edd4d7487f78b476
SHA1 4837b32e0fe3792c86c236cbf8a5ebaead104faf
SHA256 342889ee223e6dab96ef71b6669ed7449eff068eabdf2b91617660e740800625
SHA512 3b82ec852ef2a9b506e11a404587b380c61fb63f38197f362fc5296f8c04e94d4d74f42b750faf852ef4308ec228f2f195e41093ff28d46bdbeba6fdeeac9a7e

memory/1176-31-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_2af35ad61cf9a21ed49d99467f7271b2ecc93198893189a856c46d056bdded11.exe

MD5 e87ae29851a8266a0fe60ba2d5b5a11b
SHA1 aa90d622e020845a0dbcfe82fb830acb9bb7c5eb
SHA256 40460a057a875116eca7f9e86168034160c984372f685ed8dbace7812fa3fc96
SHA512 b2bde7d5b2c4a9d73052a9e86e08e37f4eb5bb1a0d7ad229df48fe8b7eee697e19a653d9acc502cb6d490f4ba18262bf1fecfb07572f2e32b9a7d7572cb7cd8c

memory/4724-13-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1176-36-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 53e750af94dfe82a8fd222ad4058f5ce
SHA1 bb78f57dd4a23fad328a1283f2ed26b6306a9cef
SHA256 fbfaac6dc6e27820dbed30248f8c9ddf775a330e67858c18e38e84ae29f319ca
SHA512 6315336707ecdcfadea63a4cf042e8cb526dbe12aaa4c2db8bd3a071966230c23514c1ab9723a7be7b5a87454c482cc4cf2186e9de2905d46ad21c6023d87607

memory/4888-86-0x00000000049A0000-0x00000000049A1000-memory.dmp

memory/4888-85-0x0000000004990000-0x0000000004991000-memory.dmp

memory/4888-84-0x00000000030D0000-0x00000000030D1000-memory.dmp

memory/4888-88-0x00000000049C0000-0x00000000049C1000-memory.dmp

memory/4888-87-0x00000000049B0000-0x00000000049B1000-memory.dmp

memory/4888-83-0x00000000030A0000-0x00000000030A1000-memory.dmp

memory/4888-82-0x0000000002D90000-0x0000000002D91000-memory.dmp

memory/4888-81-0x0000000002D80000-0x0000000002D81000-memory.dmp

memory/4888-89-0x0000000000400000-0x0000000002A98000-memory.dmp

memory/4888-92-0x0000000010000000-0x0000000010009000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\X.ico

MD5 e33fb6d686b1a8b171349572c5a33f67
SHA1 29f24fe536adf799b69b63c83efadc1bce457a54
SHA256 020c8e0963f89f4b14538b7d69e83c6fec44a29bbbd52fbb6deb2be5c697f450
SHA512 cf1f1d6a9efe53f84e5b4a8246b87c0b96496716605d1b00352d9aae30e664d3d2cbadebf598b4e690a9feef0b5785887a4e643cc5f68938ca744af1d3539e55

C:\Users\Admin\AppData\Local\Temp\RCXE6B7.tmp

MD5 d0d0c51eeeaa49308ccc48050fa7e517
SHA1 a9f86e6cc0deb3dca7499dddf870654974e699ed
SHA256 35cb2d22c9a7a12e65796da30e084fff072eca093a2f6dab67488709708383f7
SHA512 acc8b95761183ea842217aaa574e727a6200f9907043c30469a4df5dfc35fdc2ecf7bc17b535b20e22cc74cc8b7475e24b161a22499a8f6d1808a68b6df8d8bc