Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 03:38
Static task
static1
Behavioral task
behavioral1
Sample
ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe
Resource
win7-20240508-en
General
-
Target
ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe
-
Size
5.5MB
-
MD5
b02c09c1fd4db54f2b241836b404dc60
-
SHA1
173c1dbc0f0c7bab29693e3df742c064ba02d2eb
-
SHA256
ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1
-
SHA512
3b57f7ea1b88a043e64fc5c3e268935deb445e0d3111296ae19f13dbf26954a32c460648bdcbbac1a064c22e151ec3eb59bd76c2444e38d3426957e7051477b0
-
SSDEEP
98304:WGdVyVT9nOgmhQ/Zch30jrLDlw1b65KdzOOwdcW+SCBr:FWT9nO7u/I6rLDlw1BdzOOLt
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2136-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2136-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2136-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2284-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2136-26-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2588-33-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2588-37-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2284-28-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2588-41-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/2136-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2136-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2136-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2284-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2136-26-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2588-33-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2588-37-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2284-28-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat \Windows\SysWOW64\259398228.txt family_gh0strat behavioral1/memory/2588-41-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259398228.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
Processes:
svchost.exeTXPlatforn.exeTXPlatforn.exesvchos.exeHD_ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2136 svchost.exe 2284 TXPlatforn.exe 2588 TXPlatforn.exe 2548 svchos.exe 2600 HD_ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe 1656 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 8 IoCs
Processes:
ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exeTXPlatforn.exesvchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe 2284 TXPlatforn.exe 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe 2548 svchos.exe 2436 svchost.exe 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe 2436 svchost.exe 1656 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral1/memory/2136-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2136-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2136-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2136-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2284-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2136-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2588-33-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2588-37-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2284-28-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2588-41-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchost.exesvchos.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\259398228.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exedescription ioc process File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exepid process 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2588 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2136 svchost.exe Token: SeLoadDriverPrivilege 2588 TXPlatforn.exe Token: 33 2588 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2588 TXPlatforn.exe Token: 33 2588 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2588 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exepid process 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exeTXPlatforn.exesvchost.execmd.exesvchost.exedescription pid process target process PID 2140 wrote to memory of 2136 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchost.exe PID 2140 wrote to memory of 2136 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchost.exe PID 2140 wrote to memory of 2136 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchost.exe PID 2140 wrote to memory of 2136 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchost.exe PID 2140 wrote to memory of 2136 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchost.exe PID 2140 wrote to memory of 2136 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchost.exe PID 2140 wrote to memory of 2136 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchost.exe PID 2284 wrote to memory of 2588 2284 TXPlatforn.exe TXPlatforn.exe PID 2284 wrote to memory of 2588 2284 TXPlatforn.exe TXPlatforn.exe PID 2284 wrote to memory of 2588 2284 TXPlatforn.exe TXPlatforn.exe PID 2284 wrote to memory of 2588 2284 TXPlatforn.exe TXPlatforn.exe PID 2284 wrote to memory of 2588 2284 TXPlatforn.exe TXPlatforn.exe PID 2284 wrote to memory of 2588 2284 TXPlatforn.exe TXPlatforn.exe PID 2284 wrote to memory of 2588 2284 TXPlatforn.exe TXPlatforn.exe PID 2136 wrote to memory of 2576 2136 svchost.exe cmd.exe PID 2136 wrote to memory of 2576 2136 svchost.exe cmd.exe PID 2136 wrote to memory of 2576 2136 svchost.exe cmd.exe PID 2136 wrote to memory of 2576 2136 svchost.exe cmd.exe PID 2140 wrote to memory of 2548 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchos.exe PID 2140 wrote to memory of 2548 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchos.exe PID 2140 wrote to memory of 2548 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchos.exe PID 2140 wrote to memory of 2548 2140 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchos.exe PID 2576 wrote to memory of 2752 2576 cmd.exe PING.EXE PID 2576 wrote to memory of 2752 2576 cmd.exe PING.EXE PID 2576 wrote to memory of 2752 2576 cmd.exe PING.EXE PID 2576 wrote to memory of 2752 2576 cmd.exe PING.EXE PID 2436 wrote to memory of 1656 2436 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2436 wrote to memory of 1656 2436 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2436 wrote to memory of 1656 2436 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2436 wrote to memory of 1656 2436 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe"C:\Users\Admin\AppData\Local\Temp\ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exeC:\Users\Admin\AppData\Local\Temp\HD_ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259398228.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.5MB
MD51e3be8d539bda8c69d4f2a503b87f449
SHA1956d26e3f78a1e6442589a3bbdbde86b635825b5
SHA25663dc193bfda0c81181b8bffc33c3420d0955a2e98c66792261d6d4f5c61cd40b
SHA512ce0db55777e41d59fb6f9a22aec892841e9070cf9644648fd5e7d8acea130063d99562debd7898d660541e735cc4928d7a6d158533a9f4c56883102d252b308e
-
C:\Users\Admin\AppData\Local\Temp\HD_ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exeFilesize
4.0MB
MD583b33933e0e003fac4009c7843e4c7f5
SHA11d85b421174d964f3e09dc903edc9e1da6bee66f
SHA2561013f4c8c8ba5e78c761366d9d2bba8d7e36e00a4668f4f8153cbdf86b79376f
SHA51286870a74c7299376cab100f122b9c9b1a2b724c6fa0b3e493b611e4650ee74c80d69742ee798170dfaac2bedfab2dc1ed6530029ea1db607ba6b6e69129b60e8
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
\Windows\SysWOW64\259398228.txtFilesize
50KB
MD5e82665f06c35fb706106a23ab91e0488
SHA12ea33c1ca726f4b6891be7c2231d3a61cef7adfc
SHA256e7315d87be63c84947f110c8df1f3aa79a21ad06ef6d49b1a83b3f0bea232670
SHA512e39c85dcc05861421e73b8f5efafcb16e3126a57329d80d5510766f79b9eaa5ea00ec8549c02b6ed65481c38d74b75840d78faebafc6674751ebd31466290058
-
\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
memory/2136-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2136-26-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2136-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2136-9-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2136-5-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2284-28-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2284-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2588-33-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2588-37-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2588-41-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB