gh0strat | 150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
Size

7.9MB
MD5

8fb60aacdbae702cef6c315966ef338c
SHA1

4935d60a2ee95ddb9c807a52a9d98c28f1331790
SHA256

150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294
SHA512

096e57960aa0c66426555e0899f3ad7c095abc757d136ff5bcf14c5e692a4e6f51a565ddea23dfdd22002bb206e26a3235ee996be29b2112ee7ac6467221e437
SSDEEP

196608:fWT9nO7WymnHhWAwJOwDuEwUdMDSOyIN9fhjtTYIYYmKL+cqCf4J:V7BUWAwJOEujUdM2OyG9VtUIYdHY8

Score

10^/10

gh0strat purplefox bootkit discovery persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 8 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral1/memory/2180-9-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2180-8-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2180-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2784-18-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2784-34-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2912-35-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2912-39-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2912-51-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 9 IoCs

resource	yara_rule
behavioral1/memory/2180-9-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2180-8-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2180-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2784-18-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/files/0x00080000000148ac-27.dat	family_gh0strat
behavioral1/memory/2784-34-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2912-35-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2912-39-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2912-51-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259396715.txt"	svchos.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 6 IoCs

pid	Process
2180	svchost.exe
2784	TXPlatforn.exe
2712	svchos.exe
2912	TXPlatforn.exe
2588	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
668	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Loads dropped DLL 8 IoCs

pid	Process
1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
2784	TXPlatforn.exe
2712	svchos.exe
2648	svchost.exe
1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
2648	svchost.exe
668	Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2180-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2180-9-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2180-8-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2180-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2784-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2784-34-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2912-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2912-39-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2912-51-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatforn.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	svchost.exe
File created	C:\Windows\SysWOW64\259396715.txt	svchos.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	svchos.exe
File created	C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe	svchost.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000003a29d685a776db18b672b49ff0d7cb5cebc9cda725bd6013aa0a3aacfcfac300000000000e8000000002000020000000dabc99f22bf1b5afdb2936fab251491cdcbd469a07f3ef9588ccd4e90c8a713b90000000145a445b7238163dd76788d92bdc4b3698d0b7f5d70cae9710acaef8db102ea69b7bd6dd44d699eaf086ea065dec3170811f730a12bcc276836a2b284a37a66d75628606008f653f06245cbd3197416500faea8343031249d23a0f60a08d57293ba216bfe8f721bb94bb25af0b1a98b78b7c086a7b96e00603c324ea3998a81f949102a6fe234506826667e4075d9c11400000009bbb5fe88c88bba82d998998a80d9c4c25ea94345e675a1bdbba69e17698ad685458ea8542ccc04453e1f20eacd9626e65dedcc8762b1f14786f36bd53fd5360	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000521e1d777695bd9abe2faefc23e683145bdd3cbb31769e42c2804117dc848b94000000000e800000000200002000000062e93f3bcbbb7e762de8fc1c0a9a2ceb02d5bc6ae7a21917dff76fcc018ea90c20000000a2b4e25c26e0b694e1ed90598d26569e3aeba5b5456a750e02fdf5f2d3b7438240000000249c7494b9998c39fcfe9344bde940e7b794686c3179ba615969fa4cb55dd7dad803dbb4b676f72376a89feeed0395fef6a62a1ab9b5d0a7ff363a56d5c09935	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205d88a6f6c6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425478392"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C0F28A01-32E9-11EF-8189-4637C9E50E53} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2668	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
2588	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
2588	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2912	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2180	svchost.exe
Token: SeLoadDriverPrivilege	2912	TXPlatforn.exe
Token: 33	2912	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2912	TXPlatforn.exe
Token: 33	2912	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2912	TXPlatforn.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2588	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
2588	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
2588	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
2588	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
844	iexplore.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2588	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
2588	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
2588	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
2588	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
844	iexplore.exe
844	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2180	1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	28
PID 1852 wrote to memory of 2180	1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	28
PID 1852 wrote to memory of 2180	1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	28
PID 1852 wrote to memory of 2180	1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	28
PID 1852 wrote to memory of 2180	1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	28
PID 1852 wrote to memory of 2180	1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	28
PID 1852 wrote to memory of 2180	1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	28
PID 2180 wrote to memory of 2656	2180	svchost.exe	30
PID 2180 wrote to memory of 2656	2180	svchost.exe	30
PID 2180 wrote to memory of 2656	2180	svchost.exe	30
PID 2180 wrote to memory of 2656	2180	svchost.exe	30
PID 1852 wrote to memory of 2712	1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	32
PID 1852 wrote to memory of 2712	1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	32
PID 1852 wrote to memory of 2712	1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	32
PID 1852 wrote to memory of 2712	1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	32
PID 2656 wrote to memory of 2668	2656	cmd.exe	34
PID 2656 wrote to memory of 2668	2656	cmd.exe	34
PID 2656 wrote to memory of 2668	2656	cmd.exe	34
PID 2656 wrote to memory of 2668	2656	cmd.exe	34
PID 2784 wrote to memory of 2912	2784	TXPlatforn.exe	33
PID 2784 wrote to memory of 2912	2784	TXPlatforn.exe	33
PID 2784 wrote to memory of 2912	2784	TXPlatforn.exe	33
PID 2784 wrote to memory of 2912	2784	TXPlatforn.exe	33
PID 2784 wrote to memory of 2912	2784	TXPlatforn.exe	33
PID 2784 wrote to memory of 2912	2784	TXPlatforn.exe	33
PID 2784 wrote to memory of 2912	2784	TXPlatforn.exe	33
PID 1852 wrote to memory of 2588	1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	37
PID 1852 wrote to memory of 2588	1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	37
PID 1852 wrote to memory of 2588	1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	37
PID 1852 wrote to memory of 2588	1852	150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	37
PID 2648 wrote to memory of 668	2648	svchost.exe	39
PID 2648 wrote to memory of 668	2648	svchost.exe	39
PID 2648 wrote to memory of 668	2648	svchost.exe	39
PID 2648 wrote to memory of 668	2648	svchost.exe	39
PID 2588 wrote to memory of 844	2588	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	40
PID 2588 wrote to memory of 844	2588	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	40
PID 2588 wrote to memory of 844	2588	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	40
PID 2588 wrote to memory of 844	2588	HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe	40
PID 844 wrote to memory of 2484	844	iexplore.exe	41
PID 844 wrote to memory of 2484	844	iexplore.exe	41
PID 844 wrote to memory of 2484	844	iexplore.exe	41
PID 844 wrote to memory of 2484	844	iexplore.exe	41

C:\Users\Admin\AppData\Local\Temp\150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
"C:\Users\Admin\AppData\Local\Temp\150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\\svchost.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2668
- C:\Users\Admin\AppData\Local\Temp\svchos.exe
  C:\Users\Admin\AppData\Local\Temp\\svchos.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:2712
- C:\Users\Admin\AppData\Local\Temp\HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
  C:\Users\Admin\AppData\Local\Temp\HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://dl.ludashi.com/ludashi/ludashisetup.exe
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:844
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:844 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2484

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:2912

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
PID:2548

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
  C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259396715.txt",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ComputerZ.set

Filesize
40B

MD5
51a65d2eeb7ad33c64c0708bb1de986d

SHA1
d5b7d6729fab76c66b20b9dbc74a5b4db89d41cf

SHA256
e537cfd89fafed897417a222838f460d30b9092db5f5e9f27766fd511b74d55f

SHA512
acc0c5a91c32b32418f5145314b3dc1b203ad1e21396fe8ce3c7f353f20c4ac87576691dd870b425e0519e5dc163bb9aaebddfe49e73a6cf895c3b13587c2c5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.5MB

MD5
272bedf8d490dba91c7657b955d61c22

SHA1
529cd24a7bba3d88948619763f549e6e85f2b8e8

SHA256
0822eae1f2e85712b1c3afb7e37bffd34262b0207c409ccbe89173e9e9bd7465

SHA512
e42f270eb4cc35041cef3d6ed4bf713abbcdb741d2514f28fefd98787828b6be788b91a4487187ed36fa4725b45de87573a42f5421a73d36b3794506ab35c58b

Download Submit
\Users\Admin\AppData\Local\Temp\HD_150a83836ed6a4b133e9486b39ad55841f5aac6a43806d1cfae89032b135c294.exe

Filesize
6.4MB

MD5
433333d95590d6987cd2255701e0974c

SHA1
7a15a5d3dd68d8a3ff1b5ce0742ba8da0618bc07

SHA256
dbef829a072c41161020cf3f7b10754ee73071ed09e77ed3b7f8b9843d1dfd3b

SHA512
e420b2a6201b4a29974ad236491506501b8eec81d710ce20a9e55328085ed848d452e87f7d73dbf1320928f52bf8f094f40883614451f9f058c0c51150444dd4

Download Submit
\Users\Admin\AppData\Local\Temp\svchos.exe

Filesize
93KB

MD5
3b377ad877a942ec9f60ea285f7119a2

SHA1
60b23987b20d913982f723ab375eef50fafa6c70

SHA256
62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84

SHA512
af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
377KB

MD5
a4329177954d4104005bce3020e5ef59

SHA1
23c29e295e2dbb8454012d619ca3f81e4c16e85a

SHA256
6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd

SHA512
81e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208

Download Submit
\Windows\SysWOW64\259396715.txt

Filesize
50KB

MD5
fc928b3ff6b0dfb30b0bb48b1a7d9e5b

SHA1
3d8462a2ccb344a74f3c6d88d1cfb7ce06507cae

SHA256
498b6b6b17b98fa2e0d232a4cc53e1d7e864b9546044975344238cadb3b208e3

SHA512
35f7855253f1d5debcc1e9e09c6584c343e09df357e9520e24c1c2a8adb36f240351edf7b7203983c42067128b12aded46f72de72637ba39c533c94549ef6c71

Download Submit
\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
memory/2180-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2180-9-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2180-8-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2180-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2588-82-0x0000000000050000-0x0000000000DF9000-memory.dmp

Filesize
13.7MB

Download
memory/2588-66-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/2588-81-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/2588-52-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/2588-79-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/2588-76-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/2588-74-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/2588-71-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/2588-69-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/2588-54-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/2588-64-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/2588-61-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/2588-59-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/2588-57-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/2588-56-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/2784-34-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2784-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2912-51-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2912-39-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2912-35-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download