Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-06-2024 02:57
Static task
static1
Behavioral task
behavioral1
Sample
dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe
Resource
win7-20240221-en
General
-
Target
dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe
-
Size
1.9MB
-
MD5
42f3ffb37454a9230d6923f36c6b573a
-
SHA1
f6f228b8ef447fbfc8b1568d4fa93357e394efe5
-
SHA256
dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851
-
SHA512
d7e931f3ee1ca5b97d3f39cbc7bda5025bb99d594f92c0aadd379c6fa72f0a82672f3d677b6dfe972bbef21504182f9e575177823924c55b1ff9593230249f64
-
SSDEEP
24576:VQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVczGLI+5QXuRcJj2KM8+Eo0DF1:VQZAdVyVT9n/Gg0P+WhojqQXpj2j/W
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/5056-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/5056-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/5056-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1784-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1784-28-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3704-25-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1784-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1784-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3704-85-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3704-89-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3704-90-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/5056-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/5056-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/5056-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1784-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat C:\Windows\SysWOW64\240603718.txt family_gh0strat behavioral2/memory/1784-28-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3704-25-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1784-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1784-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3704-85-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3704-89-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3704-90-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240603718.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
Processes:
svchost.exeTXPlatforn.exeTXPlatforn.exesvchos.exeHD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 5056 svchost.exe 1784 TXPlatforn.exe 3704 TXPlatforn.exe 4644 svchos.exe 3932 HD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe 4312 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 3 IoCs
Processes:
svchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 4644 svchos.exe 2388 svchost.exe 4312 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral2/memory/5056-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5056-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5056-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5056-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1784-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1784-28-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3704-25-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1784-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1784-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1784-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3704-85-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3704-89-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3704-90-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchos.exesvchost.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\240603718.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe -
Drops file in Program Files directory 5 IoCs
Processes:
dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exepid process 3764 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe 3764 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 3704 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 5056 svchost.exe Token: SeLoadDriverPrivilege 3704 TXPlatforn.exe Token: 33 3704 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 3704 TXPlatforn.exe Token: 33 3704 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 3704 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exepid process 3764 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe 3764 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exeTXPlatforn.exesvchost.execmd.exesvchost.exedescription pid process target process PID 3764 wrote to memory of 5056 3764 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchost.exe PID 3764 wrote to memory of 5056 3764 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchost.exe PID 3764 wrote to memory of 5056 3764 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchost.exe PID 1784 wrote to memory of 3704 1784 TXPlatforn.exe TXPlatforn.exe PID 1784 wrote to memory of 3704 1784 TXPlatforn.exe TXPlatforn.exe PID 1784 wrote to memory of 3704 1784 TXPlatforn.exe TXPlatforn.exe PID 5056 wrote to memory of 2856 5056 svchost.exe cmd.exe PID 5056 wrote to memory of 2856 5056 svchost.exe cmd.exe PID 5056 wrote to memory of 2856 5056 svchost.exe cmd.exe PID 3764 wrote to memory of 4644 3764 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchos.exe PID 3764 wrote to memory of 4644 3764 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchos.exe PID 3764 wrote to memory of 4644 3764 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe svchos.exe PID 3764 wrote to memory of 3932 3764 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe HD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe PID 3764 wrote to memory of 3932 3764 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe HD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe PID 3764 wrote to memory of 3932 3764 dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe HD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe PID 2856 wrote to memory of 2256 2856 cmd.exe PING.EXE PID 2856 wrote to memory of 2256 2856 cmd.exe PING.EXE PID 2856 wrote to memory of 2256 2856 cmd.exe PING.EXE PID 2388 wrote to memory of 4312 2388 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2388 wrote to memory of 4312 2388 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2388 wrote to memory of 4312 2388 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe"C:\Users\Admin\AppData\Local\Temp\dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exeC:\Users\Admin\AppData\Local\Temp\HD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240603718.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.4MB
MD599dec9979d692cbfc0dc1b7be028658a
SHA135415fbeca203e49321af9ebc61f8c839257a71b
SHA256b4e4fd5c2225053efaae183dd1cca8da5ab9165b1fe4bcc9221a214464f2e6bb
SHA512b04a32e9387cf08645f569688eb8fa9b22f44602ea255718c4f3b21ae59d221193a0c9df6bb77e352922a4a612445207f108cfe08c92c0f2c4a06a1a26a5fe78
-
C:\Users\Admin\AppData\Local\Temp\HD_dfe7b7ab2b0ff256b1dd09b415d8bd0c0b74d77207a736450a812a560d8bf851.exeFilesize
437KB
MD50a72ebf5ab50b1b66057843730813005
SHA140ffbe8f2fc30407145ee896ad166d08562acc30
SHA256d32f4227a312abc42fca893f17b947420330f67b371bdf6d1a3e8dc241d53514
SHA51256b8acffb6ce9f26ce4263c981df2d76ad183de52c86c04e7c73e819cb2b38784de2d8401f5d93609b29ede5209779f152b01ee5be053c72ec339a08e86020f0
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
C:\Windows\SysWOW64\240603718.txtFilesize
50KB
MD510a114c183a0d9a6f21ddf14b1d639ef
SHA1c7c20a917b72bb6ce6410e5cdc0544d061cea7a4
SHA256e62ce926671bbf8eb4ba7eccc0f5cbce52119081a0be62a8713d276d9af3be51
SHA51220db4c669b8a67b7f162ce1234e93857242100f371320cd4b343c8858a678e63971667836e4e8387587df03648e623cf6ae10b12ffab9c5dcced4b391c301e36
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
memory/1784-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1784-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1784-28-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1784-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1784-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3704-25-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3704-85-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3704-89-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3704-90-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5056-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5056-10-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5056-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5056-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB