Malware Analysis Report

2025-01-02 15:19

Sample ID 240625-vkhdvsvdln
Target d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5
SHA256 d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5
Tags
gh0strat purplefox bootkit discovery persistence rat rootkit trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5

Threat Level: Known bad

The file d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5 was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox bootkit discovery persistence rat rootkit trojan upx

Detect PurpleFox Rootkit

PurpleFox

Gh0st RAT payload

Gh0strat

Sets service image path in registry

Drops file in Drivers directory

UPX packed file

Loads dropped DLL

Executes dropped EXE

Writes to the Master Boot Record (MBR)

Checks installed software on the system

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 17:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 17:02

Reported

2024-06-25 17:05

Platform

win7-20240611-en

Max time kernel

150s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a754da21c7da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7447E61-3314-11EF-A381-7EE57A38E3C7} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425496848" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000001a13f731f6e040737faabc700b86ff83cce5b009ff936686a022ea0c32ac0db4000000000e80000000020000200000008049222ecaf94719fcb0852f3cbf915ad7f01392f61bdeb48b4b571396c3b0c62000000051adb70854eec87bf4e94c9d231e076fa39da752a07136787ff4b15483f00740400000003fad446128e5eaa14eb6e0207c184a22112ec090bfce3dca36b3eb7bf806e138c02694fb848f084f5c3d486d80fb57c5cd88f2ba8b65c7bdd53faaa7aa4dfe6d C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000b2b4716315343127205bfc85986035753d99052ec75193446585e03efe7ef3aa000000000e8000000002000020000000c89d32323c5ad3c32de5678dd6ebb0f56e5c90a709a5052f983f47036f347214900000003892ecd4df26247e0a0dea8e1cf91fb0e8e7e8bb9ae6286d099bbd4c8f39d2935ab6586e09b53c4702727ea42ec95a00a2c3bc8e697945832263e06999602034d298200aad0ff2932cb3b81dd39579fbbce3b3f47b1ab4da630f9b6f600457e33ad8ae50f9209cf533a64f68b6da3ba4011317935ed06bcbc306e51552b156cc3ce4812c467fb2d3abab2cc75afee0544000000011ee3394e75b1ae61b6f64a33cb0064109da99923aac2bba9caedfa0cb25bd1086a073fce2ce3b8916f05c392a46b2fe361160d1dbb1e425c6c74a62ed5ba2d9 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2940 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2940 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2940 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2940 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2940 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2940 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2940 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 3000 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 3000 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 3000 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 3000 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2684 wrote to memory of 2652 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2684 wrote to memory of 2652 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2684 wrote to memory of 2652 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2684 wrote to memory of 2652 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2684 wrote to memory of 2652 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2684 wrote to memory of 2652 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2684 wrote to memory of 2652 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2720 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2720 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2720 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2720 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2940 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe
PID 2940 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe
PID 2940 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe
PID 2940 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe
PID 2808 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2808 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2808 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2808 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2660 wrote to memory of 932 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2660 wrote to memory of 932 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2660 wrote to memory of 932 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2660 wrote to memory of 932 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe

"C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe

C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://dl.ludashi.com/ludashi/ludashisetup.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 s.ludashi.com udp
CN 106.15.139.192:80 s.ludashi.com tcp
CN 106.15.139.192:80 s.ludashi.com tcp
US 8.8.8.8:53 dl.ludashi.com udp
CN 61.170.77.225:80 dl.ludashi.com tcp
CN 61.170.77.225:80 dl.ludashi.com tcp
CN 61.170.77.223:80 dl.ludashi.com tcp
CN 61.170.77.223:80 dl.ludashi.com tcp
CN 61.170.77.227:80 dl.ludashi.com tcp
CN 61.170.77.227:80 dl.ludashi.com tcp
CN 61.170.77.221:80 dl.ludashi.com tcp
CN 61.170.77.221:80 dl.ludashi.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
CN 61.170.77.222:80 dl.ludashi.com tcp
CN 61.170.77.222:80 dl.ludashi.com tcp

Files

\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/3000-5-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3000-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3000-8-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3000-9-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2684-18-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2684-21-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2652-28-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2652-27-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2652-25-0x0000000010000000-0x00000000101B6000-memory.dmp

\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe

MD5 433333d95590d6987cd2255701e0974c
SHA1 7a15a5d3dd68d8a3ff1b5ce0742ba8da0618bc07
SHA256 dbef829a072c41161020cf3f7b10754ee73071ed09e77ed3b7f8b9843d1dfd3b
SHA512 e420b2a6201b4a29974ad236491506501b8eec81d710ce20a9e55328085ed848d452e87f7d73dbf1320928f52bf8f094f40883614451f9f058c0c51150444dd4

memory/2652-33-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2652-36-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2652-38-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2808-41-0x0000000000080000-0x0000000000081000-memory.dmp

memory/2808-39-0x0000000000080000-0x0000000000081000-memory.dmp

memory/2808-43-0x0000000000080000-0x0000000000081000-memory.dmp

memory/2808-46-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/2808-44-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/2808-48-0x00000000000E0000-0x00000000000E1000-memory.dmp

memory/2808-53-0x00000000000F0000-0x00000000000F1000-memory.dmp

memory/2808-51-0x00000000000F0000-0x00000000000F1000-memory.dmp

memory/2808-56-0x0000000000100000-0x0000000000101000-memory.dmp

memory/2808-58-0x0000000000100000-0x0000000000101000-memory.dmp

memory/2808-61-0x0000000000110000-0x0000000000111000-memory.dmp

memory/2808-63-0x0000000000110000-0x0000000000111000-memory.dmp

memory/2808-66-0x00000000001A0000-0x00000000001A1000-memory.dmp

memory/2808-68-0x00000000001A0000-0x00000000001A1000-memory.dmp

memory/2808-69-0x0000000001140000-0x0000000001EE9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 0d7c017a3bb891614f3f8dc69c24b8ed
SHA1 eb5e99839f0de1322df19eddddcacba854928de0
SHA256 e5b553af3d8e451c389d991ee95d230f0c99bd099b70f562d0c6629504308477
SHA512 a1108ec939686d81561c31e7306834781006263ca0e27b42a31d5ee194fc510d513f91e31b505e9a80791520d36452e5a715cd30dd2cf754496d419eae134df6

C:\Users\Admin\AppData\Local\Temp\ComputerZ.set

MD5 41a782993c791e5255c5b92515ff8873
SHA1 ff46f8f913685f6dafb94567aec1ee4403566ac0
SHA256 3be3b34b39d3ecaf9867057d886c53c3f0430a4a57803cf6d6a0b1a3dc583b88
SHA512 ec30e4a0a06c561b73d023417fcacb3cad728f39453156c5e6435968cf299d4519a6d0eca5a5ea4f930231c3b49bb465c0b14069fd258853c895816140e3cb02

C:\Users\Admin\AppData\Local\Temp\Cab59E3.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar5A84.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e6142ae7bbc6cdf5bac892e696ab8105
SHA1 0fa2974fcdd59c619eb7e052be3ad9213e5ddaf5
SHA256 cdc02bbd5239f9312efebc2fb3b40e84bd73d306a09ed8dc118e7a5445f17367
SHA512 ba97deffc04fa0a6266108cb25ac082580516aee6abc24e9156fe39d4cdbfa4bceff1dc73fd04e6051bd02787f4d9b252e067f322ce274961c3b75559166bbc7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7f366ca549de8710033609d941cb6ab7
SHA1 79a6811016d3fd6177dd4614bf2bc3f70e7f6115
SHA256 89ff9599bb47df34c8693cc5c7808643bb09f169ca09064ddb5f5e7e7bb37036
SHA512 ac9872a0208f984ba1994b9b8e67e25ddb626a58b33c361a05ef7f086a89704814ee98aa43c97936692e9bea3786d5e05f3540517307646b936ea184d9b77bf9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5b987e3d4061ede14006e9018e2d7dd1
SHA1 c245fec9493d37d8f18cde83944900a4a017ef82
SHA256 d8d9defb4d440f29121679e352f799eff3db188b703e5562b3c26a5fc340f3e7
SHA512 add1b8a1ee5945e21e1166dbd1aa6e7deba9158879a5964d3d3957873705b4b58a5acac4567c414cad963b53c289393f5eb5eea543b47cac58a0c31117c98445

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 25b244e94432cf9c8a9cae95034db84a
SHA1 af00ca59e3da157883b9c118add6d94c1219fd94
SHA256 17348bf16150b0e0f1affddaf5c356f5469481c84c71045898e20f5f1be201d5
SHA512 2deaf57336ad6d6c64ab4805c81bbf9bed5ddae9609619cbcfb29c4118c5d683b13bec3738ec4a1c6ba968dddd817bb8a57731042df7274b6f2aaa764adfecca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 69a13b29b09238bf08a43320f56f4746
SHA1 a42b38f177c0028ccc80c5f0a5e52eed781b0832
SHA256 e16017bb14692fc96acad3341bdc3f21269992ee7919e96dde544dee103eeb1b
SHA512 7bd18cd62a969a50c6c122d7ac88fba1ee5a88c953ad285802429b6c4a49742a800c96532adc2bed60a53a9d135fc398986a7888f63c72db79fb8ccba81be678

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d1fa322929a06cfa3ee0581faf24d83f
SHA1 c2b5a61e9386ce3b2e5a5947a8cf585ca7a54f55
SHA256 fce2c7692ee995f1e642d97f84b07db4df365e1c481bf8e6074c2c47baa534dc
SHA512 38311e76413f97d52ac2519cc14beb5925221b06e1027a02910978c40e5a240ac51a74f331b91b907886b5b973663ca04d4ed3b3159339e8d9adeca67af6e4ad

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8fdf634648be8b32f013a62494a2deaf
SHA1 19d4c1d7f6cc32dcbd5cbdc9eeef98b829549e4e
SHA256 11e9da0fba2dd411c079e9ecbda88d2e297999c56ef1144d89a621b98dac84ca
SHA512 3641ce0d3727732591f47d0944687bf972cf63360ceb5fa071cf041a71083084f006e33931c2882a810b3e3dd6e70ee46502bda2d32fb30eab6f3b2f759b1d96

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bf323ade53f9731be10c616e6ae378ea
SHA1 e02dbaeaa1f53554cc83849de24f6ad0c8c96ed4
SHA256 625831caf01bb8f0ae906233be6ac93e36e0d6423cf67445ccc2a8d0465ebf23
SHA512 c7d554501d861214be368b940a8360be4f1605f92519befe63d1782c22305644f6d65590f57ea6e2445745c47914af49f4c6b4ca871cdda272deac6151e3b336

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c135175c373940f9e54e56035c4e6092
SHA1 b50201a78fe9b38d4d8abf29bf6a440a6eb0f237
SHA256 a55de21151a9bc4abf86c1060bd21fe9bbbdd435d884cd083d13fc6b5f2a698e
SHA512 ac014b8f0e8e9afd8ed528335997a5dc692f2c9d87e6654fc2be820431a5b1514aff67bca6d683b904b692b81a9444e422f66d05361b51bd0c3b46f240090a80

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 42e84fa919b5708d2f524ddaa965d9f2
SHA1 6a789c9892ed7ef1752c3b31c456413f32a1fcf8
SHA256 44cec46ec34cec61cfa9d9a19c2ff29ce173765b6ed86866df6ce008550e6f13
SHA512 086f719d5034a29ff19b301d51747e75d288264c7cdd41d64533416fc438b3bf420780189f510501f1490517acb26b07db1864a97ba6188b055cc171cc4f9439

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a12ff9c2218431657fd455b52e6bcb65
SHA1 1763800c81d41de9717ecc1e0bdae6ef606c23d5
SHA256 4ae65b53d4373e0e5caece8222402d3156bfbcb0883cab18c17bb7b3559799d4
SHA512 77aed8501497b7686be6f5dcf3606f1b1c79c018843a5fa7bb57aaa186bdcb7d36c9b73afdc453b278420830d1811806e2f2ed3980691cc746b57c9858268aaa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4e04d045086b442f03bdc6adbfaa7c5e
SHA1 15c678c12e5f601f144d65db2d7fddb3b967560d
SHA256 54d03f51ddd13d2867d7870a611a8f8428e5875871a20a27f36e8b608a75467a
SHA512 0046228dd99d4adc662772a82c4b6deacc9c3d7b8ccecb8fac5010991b50979705a28c18bd97d4cef151278f6ee2a35335b38e15eca289566cad5042935bfdd4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 db66616a4268f9e5f51ed4cc24c859f0
SHA1 a2fd238c72ab61499546b5f6715106e53e6371fb
SHA256 21eee27b56fe7d90cc95a1af12efc74806dad1f08277082e6689f536575fe7ac
SHA512 e24de5c358dd4c282d7f67d0388216ddda03a0d252c362f3b482ab56f5ec9dcdb326d26cacb2a9bc9d34cb0c3778b26ae13117ba653fe667228f084e20a01449

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c2d6352756a5921668630900991c661
SHA1 40812672b1c668707e1d552786fb3a707b94835c
SHA256 5c1b610f369ad3a1da937e5a900f5c9c38cb5ae92b5c61e7af0c0ad3d7586601
SHA512 f16fa341d4fe2bb72442709f8ae6b6a15a8ecf13f84f3d5f2c3a781f55e0fa3eee220f7b0ec5ccfdd9e80952c0e78a66510f35d2957aa54c5f31414961a3774e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 abc3b223758e54af3cff940609f80a87
SHA1 7ef16a13d50e290704785a2c2e5afd27b875f7b3
SHA256 5c82ef35c25a611f99d6ed0b13ce4526896d8e9464c366570143e1c52c2507b4
SHA512 8cc49d1f56ff5b82ad2a1a90263d0a7317df015cc7e037ca7a7b082fba6c44b211176dc0058f7581ef1a11e2d612f79f52182da299d4c2b8900acec5a9c7f964

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3da15d1dde4e860cb2dd73e9fa2f4151
SHA1 7e8c969e1b0ebac437ae0912e2980c0a0119cac2
SHA256 6ccaee327a86490298937a8a1504cb27fbf11eb026b8771974ea6f1afd020a17
SHA512 2e81a7edbe72a5d319446a0d0013206539b18a53cd618249f3613125399b0d885b90dbea22095e1e0bf39bb5307646e9088dc4cd6496fbbd11d7fa67017330ac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 25eae5231047b18b2b58e152c4b9ed21
SHA1 a70e10109d4d1ba5f6fd2f5e9d09a30b418d9c68
SHA256 5926e6cd770d5bda5905fbb8cb62bca6b67993a5a27326cff8b5f64e1ea7f45b
SHA512 05e1498b0d2980bddb60ca0d0f9193c7afb52b8a821da52c19021572308584dea154dacd3312be35a7cee0a66972beeb985a7955fff3044c8f21f96f2d83da29

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bc19ec4869cda64added7c4d39fcaa24
SHA1 4419dd3bea4047124b0879dcfaaffc4f8e8af654
SHA256 3da1f621f1d621fc1f05cd726ca1188e52d50ab716dedeab71f28e83aff34d6a
SHA512 1af69cedfd1780a0c851849a2ba0794a7ddbf470c3d101aa919f04cd6c4e48592d047d4daf1e2ed46bca43adb6a56e2ee46411158aa620bc20666f607e1e2076

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ded34471cf8801d00dee9eecaf44ad01
SHA1 87f4252915eddd5aeb357278200a9a49121101e8
SHA256 e0ac54999468b6ef5c02839b09592a3f8051dac9a038592f0c45863247a01a51
SHA512 d759dd3968f5d06bff637418804b62356b2276cd8b489f2f57a9fb2c13814e5f1f4eca377872473135c773ae7da189e79b9bccef1ea0dd1908f543b183dcf890

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 17:02

Reported

2024-06-25 17:05

Platform

win10v2004-20240226-en

Max time kernel

152s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks installed software on the system

discovery

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 868 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 868 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 868 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 3968 wrote to memory of 1980 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3968 wrote to memory of 1980 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 3968 wrote to memory of 1980 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2000 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 368 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 868 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe
PID 868 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe
PID 868 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe
PID 368 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 368 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 368 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 5088 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5088 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe

"C:\Users\Admin\AppData\Local\Temp\d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe

C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://dl.ludashi.com/ludashi/ludashisetup.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3908 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4312 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4984 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5372 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5520 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 s.ludashi.com udp
CN 106.15.139.192:80 s.ludashi.com tcp
CN 106.15.139.192:80 s.ludashi.com tcp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 216.58.204.74:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 i.pki.goog udp
US 8.8.8.8:53 i.pki.goog udp
GB 142.250.200.3:80 i.pki.goog tcp
US 8.8.8.8:53 29.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 dl.ludashi.com udp
US 8.8.8.8:53 dl.ludashi.com udp
US 8.8.8.8:53 dl.ludashi.com udp
CN 101.226.28.239:80 dl.ludashi.com tcp
CN 101.226.28.239:80 dl.ludashi.com tcp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 dl.ludashi.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 dl.ludashi.com udp
US 8.8.8.8:53 dl.ludashi.com udp
GB 51.140.242.104:443 nav-edge.smartscreen.microsoft.com tcp
GB 51.140.242.104:443 nav-edge.smartscreen.microsoft.com tcp
US 13.107.6.158:443 business.bing.com tcp
CN 61.170.79.228:443 dl.ludashi.com tcp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
FR 92.122.166.26:443 bzib.nelreports.net tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
CN 61.170.79.228:443 dl.ludashi.com tcp
US 23.219.240.231:443 www.microsoft.com tcp
US 8.8.8.8:53 167.57.26.184.in-addr.arpa udp
US 8.8.8.8:53 104.242.140.51.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 231.240.219.23.in-addr.arpa udp
US 8.8.8.8:53 26.166.122.92.in-addr.arpa udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 dl.ludashi.com udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 3.166.122.92.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 104.208.16.94:443 nw-umwatson.events.data.microsoft.com tcp
CN 101.226.28.235:80 dl.ludashi.com tcp
US 8.8.8.8:53 94.16.208.104.in-addr.arpa udp
CN 101.226.28.235:80 dl.ludashi.com tcp
CN 61.170.81.239:443 dl.ludashi.com tcp
CN 61.170.81.239:443 dl.ludashi.com tcp
N/A 224.0.0.251:5353 udp
BE 23.41.178.81:443 www.bing.com tcp
US 8.8.8.8:53 81.178.41.23.in-addr.arpa udp
CN 101.226.28.236:80 dl.ludashi.com tcp
CN 101.226.28.236:80 dl.ludashi.com tcp
CN 61.170.80.231:443 dl.ludashi.com tcp
CN 61.170.80.231:443 dl.ludashi.com tcp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
CN 101.226.28.240:80 dl.ludashi.com tcp
CN 101.226.28.240:80 dl.ludashi.com tcp
CN 101.226.28.237:443 dl.ludashi.com tcp
CN 101.226.28.237:443 dl.ludashi.com tcp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
CN 101.226.28.241:80 dl.ludashi.com tcp
CN 101.226.28.241:80 dl.ludashi.com tcp
CN 61.170.81.240:443 dl.ludashi.com tcp
CN 61.170.81.240:443 dl.ludashi.com tcp
BE 23.41.178.64:443 www.bing.com tcp
US 8.8.8.8:53 64.178.41.23.in-addr.arpa udp
CN 101.226.28.238:80 dl.ludashi.com tcp
CN 101.226.28.238:80 dl.ludashi.com tcp
CN 114.80.179.245:443 dl.ludashi.com tcp
CN 114.80.179.245:443 dl.ludashi.com tcp
US 8.8.8.8:53 137.71.105.51.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp

Files

C:\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/2000-4-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2000-6-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2000-8-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2000-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3968-13-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3968-16-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3968-17-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3968-15-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/3968-24-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2000-19-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1980-28-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1980-27-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_d593a9142de589bc8d4990ba88dbc3491976584290f871afdf95c4b8ed9bd2b5.exe

MD5 433333d95590d6987cd2255701e0974c
SHA1 7a15a5d3dd68d8a3ff1b5ce0742ba8da0618bc07
SHA256 dbef829a072c41161020cf3f7b10754ee73071ed09e77ed3b7f8b9843d1dfd3b
SHA512 e420b2a6201b4a29974ad236491506501b8eec81d710ce20a9e55328085ed848d452e87f7d73dbf1320928f52bf8f094f40883614451f9f058c0c51150444dd4

memory/1980-36-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 0d7c017a3bb891614f3f8dc69c24b8ed
SHA1 eb5e99839f0de1322df19eddddcacba854928de0
SHA256 e5b553af3d8e451c389d991ee95d230f0c99bd099b70f562d0c6629504308477
SHA512 a1108ec939686d81561c31e7306834781006263ca0e27b42a31d5ee194fc510d513f91e31b505e9a80791520d36452e5a715cd30dd2cf754496d419eae134df6

memory/5088-84-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

memory/5088-83-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

memory/5088-82-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

memory/5088-81-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

memory/5088-80-0x00000000014F0000-0x00000000014F1000-memory.dmp

memory/5088-79-0x00000000014D0000-0x00000000014D1000-memory.dmp

memory/5088-85-0x0000000000080000-0x0000000000E29000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ComputerZ.set

MD5 46e76a0fcc74d9161b697caa4e7971f0
SHA1 e83024bb0b86f05a5e2d9184f24e2af62a06c86f
SHA256 4a011c8117582ba91320e8b92f995e36749369aaff94adb0d420cbbf3ed3aa66
SHA512 590a0e6388b8cdded100a42df882fe58516d87d685291c68225a2f433c6992d5f66be6079763d4fa7abad30d1e203ffe16f4a338ae044e7de860176fcc66ab8d

C:\Users\Admin\AppData\Local\Temp\X.ico

MD5 e33fb6d686b1a8b171349572c5a33f67
SHA1 29f24fe536adf799b69b63c83efadc1bce457a54
SHA256 020c8e0963f89f4b14538b7d69e83c6fec44a29bbbd52fbb6deb2be5c697f450
SHA512 cf1f1d6a9efe53f84e5b4a8246b87c0b96496716605d1b00352d9aae30e664d3d2cbadebf598b4e690a9feef0b5785887a4e643cc5f68938ca744af1d3539e55

C:\Users\Admin\AppData\Local\Temp\RCX9F5D.tmp

MD5 a44b78a78bd8a8a4abfa36a7ca85c13a
SHA1 f1066399612a2e3eabe3f54eb6930a6074785e2f
SHA256 4ce2542b66463ff761d0994beb5a2c629a93c747720798f6f909586fb8a35f00
SHA512 815ea6b703a86a447c3ecc186c94afd8f5ab7fae0ca2fd7acae3a35f16e623274c894c8e53b52f6a77d956aee6bb32217f7d6e8efebdd3f1dee0874338c6265f