Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-06-2024 02:57
Static task
static1
Behavioral task
behavioral1
Sample
dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe
Resource
win7-20240221-en
General
-
Target
dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe
-
Size
1.9MB
-
MD5
42f3ffb37454a9230d6923f36c6b573a
-
SHA1
f6f228b8ef447fbfc8b1568d4fa93357e394efe5
-
SHA256
dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851
-
SHA512
d7e931f3ee1ca5b97d3f39cbc7bda5025bb99d594f92c0aadd379c6fa72f0a82672f3d677b6dfe972bbef21504182f9e575177823924c55b1ff9593230249f64
-
SSDEEP
24576:VQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVczGLI+5QXuRcJj2KM8+Eo0DF1:VQZAdVyVT9n/Gg0P+WhojqQXpj2j/W
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1840-12-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1840-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1840-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2072-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2072-34-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2684-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2684-38-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2684-52-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1840-12-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1840-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1840-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2072-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat \Windows\SysWOW64\259395108.txt family_gh0strat behavioral1/memory/2072-34-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2684-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2684-38-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2684-52-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259395108.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
Processes:
svchost.exeTXPlatforn.exesvchos.exeTXPlatforn.exeHD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 1840 svchost.exe 2072 TXPlatforn.exe 2536 svchos.exe 2684 TXPlatforn.exe 2500 HD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe 300 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 8 IoCs
Processes:
dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exeTXPlatforn.exesvchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe 2072 TXPlatforn.exe 2536 svchos.exe 308 svchost.exe 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe 308 svchost.exe 300 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral1/memory/1840-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1840-12-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1840-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1840-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2072-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2072-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2684-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2684-38-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2684-52-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchos.exesvchost.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\259395108.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exepid process 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2684 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 1840 svchost.exe Token: SeLoadDriverPrivilege 2684 TXPlatforn.exe Token: 33 2684 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2684 TXPlatforn.exe Token: 33 2684 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2684 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exepid process 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exesvchost.exeTXPlatforn.execmd.exesvchost.exedescription pid process target process PID 2240 wrote to memory of 1840 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchost.exe PID 2240 wrote to memory of 1840 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchost.exe PID 2240 wrote to memory of 1840 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchost.exe PID 2240 wrote to memory of 1840 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchost.exe PID 2240 wrote to memory of 1840 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchost.exe PID 2240 wrote to memory of 1840 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchost.exe PID 2240 wrote to memory of 1840 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchost.exe PID 1840 wrote to memory of 2596 1840 svchost.exe cmd.exe PID 1840 wrote to memory of 2596 1840 svchost.exe cmd.exe PID 1840 wrote to memory of 2596 1840 svchost.exe cmd.exe PID 1840 wrote to memory of 2596 1840 svchost.exe cmd.exe PID 2240 wrote to memory of 2536 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchos.exe PID 2240 wrote to memory of 2536 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchos.exe PID 2240 wrote to memory of 2536 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchos.exe PID 2240 wrote to memory of 2536 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchos.exe PID 2072 wrote to memory of 2684 2072 TXPlatforn.exe TXPlatforn.exe PID 2072 wrote to memory of 2684 2072 TXPlatforn.exe TXPlatforn.exe PID 2072 wrote to memory of 2684 2072 TXPlatforn.exe TXPlatforn.exe PID 2072 wrote to memory of 2684 2072 TXPlatforn.exe TXPlatforn.exe PID 2072 wrote to memory of 2684 2072 TXPlatforn.exe TXPlatforn.exe PID 2072 wrote to memory of 2684 2072 TXPlatforn.exe TXPlatforn.exe PID 2072 wrote to memory of 2684 2072 TXPlatforn.exe TXPlatforn.exe PID 2596 wrote to memory of 2700 2596 cmd.exe PING.EXE PID 2596 wrote to memory of 2700 2596 cmd.exe PING.EXE PID 2596 wrote to memory of 2700 2596 cmd.exe PING.EXE PID 2596 wrote to memory of 2700 2596 cmd.exe PING.EXE PID 2240 wrote to memory of 2500 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe HD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe PID 2240 wrote to memory of 2500 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe HD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe PID 2240 wrote to memory of 2500 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe HD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe PID 2240 wrote to memory of 2500 2240 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe HD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe PID 308 wrote to memory of 300 308 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 308 wrote to memory of 300 308 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 308 wrote to memory of 300 308 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 308 wrote to memory of 300 308 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe"C:\Users\Admin\AppData\Local\Temp\dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exeC:\Users\Admin\AppData\Local\Temp\HD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259395108.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.4MB
MD599dec9979d692cbfc0dc1b7be028658a
SHA135415fbeca203e49321af9ebc61f8c839257a71b
SHA256b4e4fd5c2225053efaae183dd1cca8da5ab9165b1fe4bcc9221a214464f2e6bb
SHA512b04a32e9387cf08645f569688eb8fa9b22f44602ea255718c4f3b21ae59d221193a0c9df6bb77e352922a4a612445207f108cfe08c92c0f2c4a06a1a26a5fe78
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
\Users\Admin\AppData\Local\Temp\HD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exeFilesize
437KB
MD50a72ebf5ab50b1b66057843730813005
SHA140ffbe8f2fc30407145ee896ad166d08562acc30
SHA256d32f4227a312abc42fca893f17b947420330f67b371bdf6d1a3e8dc241d53514
SHA51256b8acffb6ce9f26ce4263c981df2d76ad183de52c86c04e7c73e819cb2b38784de2d8401f5d93609b29ede5209779f152b01ee5be053c72ec339a08e86020f0
-
\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
\Windows\SysWOW64\259395108.txtFilesize
50KB
MD510a114c183a0d9a6f21ddf14b1d639ef
SHA1c7c20a917b72bb6ce6410e5cdc0544d061cea7a4
SHA256e62ce926671bbf8eb4ba7eccc0f5cbce52119081a0be62a8713d276d9af3be51
SHA51220db4c669b8a67b7f162ce1234e93857242100f371320cd4b343c8858a678e63971667836e4e8387587df03648e623cf6ae10b12ffab9c5dcced4b391c301e36
-
\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
memory/1840-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1840-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1840-12-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1840-5-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2072-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2072-34-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2684-36-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2684-38-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2684-52-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB