Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 03:38
Static task
static1
Behavioral task
behavioral1
Sample
ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe
Resource
win7-20240508-en
General
-
Target
ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe
-
Size
5.5MB
-
MD5
b02c09c1fd4db54f2b241836b404dc60
-
SHA1
173c1dbc0f0c7bab29693e3df742c064ba02d2eb
-
SHA256
ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1
-
SHA512
3b57f7ea1b88a043e64fc5c3e268935deb445e0d3111296ae19f13dbf26954a32c460648bdcbbac1a064c22e151ec3eb59bd76c2444e38d3426957e7051477b0
-
SSDEEP
98304:WGdVyVT9nOgmhQ/Zch30jrLDlw1b65KdzOOwdcW+SCBr:FWT9nO7u/I6rLDlw1BdzOOLt
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1748-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1748-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1748-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3400-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3400-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3400-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3308-40-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3308-44-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3308-27-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3400-23-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3308-90-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/1748-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1748-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1748-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3400-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3400-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3400-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat C:\Windows\SysWOW64\240596625.txt family_gh0strat behavioral2/memory/3308-40-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3308-44-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3308-27-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3400-23-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3308-90-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240596625.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
Processes:
svchost.exeTXPlatforn.exeTXPlatforn.exesvchos.exeHD_ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 1748 svchost.exe 3400 TXPlatforn.exe 3308 TXPlatforn.exe 1592 svchos.exe 5052 HD_ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe 1824 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 3 IoCs
Processes:
svchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 1592 svchos.exe 2660 svchost.exe 1824 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral2/memory/1748-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1748-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1748-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1748-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3400-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3400-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3400-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3400-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3308-40-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3308-44-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3308-27-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3400-23-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3308-90-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchost.exesvchos.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\240596625.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe -
Drops file in Program Files directory 5 IoCs
Processes:
ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exepid process 640 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe 640 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 3308 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 1748 svchost.exe Token: SeLoadDriverPrivilege 3308 TXPlatforn.exe Token: 33 3308 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 3308 TXPlatforn.exe Token: 33 3308 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 3308 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exepid process 640 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe 640 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exesvchost.exeTXPlatforn.execmd.exesvchost.exedescription pid process target process PID 640 wrote to memory of 1748 640 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchost.exe PID 640 wrote to memory of 1748 640 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchost.exe PID 640 wrote to memory of 1748 640 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchost.exe PID 1748 wrote to memory of 1472 1748 svchost.exe cmd.exe PID 1748 wrote to memory of 1472 1748 svchost.exe cmd.exe PID 1748 wrote to memory of 1472 1748 svchost.exe cmd.exe PID 3400 wrote to memory of 3308 3400 TXPlatforn.exe TXPlatforn.exe PID 3400 wrote to memory of 3308 3400 TXPlatforn.exe TXPlatforn.exe PID 3400 wrote to memory of 3308 3400 TXPlatforn.exe TXPlatforn.exe PID 640 wrote to memory of 1592 640 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchos.exe PID 640 wrote to memory of 1592 640 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchos.exe PID 640 wrote to memory of 1592 640 ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe svchos.exe PID 1472 wrote to memory of 532 1472 cmd.exe PING.EXE PID 1472 wrote to memory of 532 1472 cmd.exe PING.EXE PID 1472 wrote to memory of 532 1472 cmd.exe PING.EXE PID 2660 wrote to memory of 1824 2660 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2660 wrote to memory of 1824 2660 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2660 wrote to memory of 1824 2660 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe"C:\Users\Admin\AppData\Local\Temp\ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exeC:\Users\Admin\AppData\Local\Temp\HD_ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240596625.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_ffe5298dcc13151e147b76e75fb130be84d1d380721ce1d5dcfaabcf02a955f1.exeFilesize
4.0MB
MD583b33933e0e003fac4009c7843e4c7f5
SHA11d85b421174d964f3e09dc903edc9e1da6bee66f
SHA2561013f4c8c8ba5e78c761366d9d2bba8d7e36e00a4668f4f8153cbdf86b79376f
SHA51286870a74c7299376cab100f122b9c9b1a2b724c6fa0b3e493b611e4650ee74c80d69742ee798170dfaac2bedfab2dc1ed6530029ea1db607ba6b6e69129b60e8
-
C:\Users\Admin\AppData\Local\Temp\RCX377B.tmpFilesize
1.5MB
MD51e3be8d539bda8c69d4f2a503b87f449
SHA1956d26e3f78a1e6442589a3bbdbde86b635825b5
SHA25663dc193bfda0c81181b8bffc33c3420d0955a2e98c66792261d6d4f5c61cd40b
SHA512ce0db55777e41d59fb6f9a22aec892841e9070cf9644648fd5e7d8acea130063d99562debd7898d660541e735cc4928d7a6d158533a9f4c56883102d252b308e
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
C:\Windows\SysWOW64\240596625.txtFilesize
50KB
MD5e82665f06c35fb706106a23ab91e0488
SHA12ea33c1ca726f4b6891be7c2231d3a61cef7adfc
SHA256e7315d87be63c84947f110c8df1f3aa79a21ad06ef6d49b1a83b3f0bea232670
SHA512e39c85dcc05861421e73b8f5efafcb16e3126a57329d80d5510766f79b9eaa5ea00ec8549c02b6ed65481c38d74b75840d78faebafc6674751ebd31466290058
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
memory/1748-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1748-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1748-10-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1748-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3308-44-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3308-40-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3308-27-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3308-90-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3400-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3400-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3400-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3400-23-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3400-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB