Malware Analysis Report

2025-01-02 15:19

Sample ID 240625-vn4q9ssdjc
Target 0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0
SHA256 0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0
Tags
gh0strat purplefox persistence rat rootkit trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0

Threat Level: Known bad

The file 0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0 was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox persistence rat rootkit trojan upx

Gh0strat

PurpleFox

Detect PurpleFox Rootkit

Gh0st RAT payload

Sets service image path in registry

Drops file in Drivers directory

Executes dropped EXE

UPX packed file

Loads dropped DLL

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Runs ping.exe

Suspicious behavior: LoadsDriver

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 17:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 17:09

Reported

2024-06-25 17:11

Platform

win7-20240611-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\HD_0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2132 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2132 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2132 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2132 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2132 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2132 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2132 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2356 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2356 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2356 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2356 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2764 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2996 wrote to memory of 2764 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2996 wrote to memory of 2764 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2996 wrote to memory of 2764 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2996 wrote to memory of 2764 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2996 wrote to memory of 2764 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2996 wrote to memory of 2764 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2132 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\HD_0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe
PID 2132 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\HD_0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe
PID 2132 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\HD_0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe
PID 2132 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\HD_0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe
PID 2752 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2752 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2752 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2752 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe

"C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe

C:\Users\Admin\AppData\Local\Temp\HD_0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 api1.rocokl.me udp
US 74.48.89.151:443 api1.rocokl.me tcp
US 8.8.8.8:53 note.youdao.com udp
GB 79.133.176.166:443 note.youdao.com tcp

Files

\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/2356-5-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2356-8-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2356-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2356-12-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2996-18-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2996-24-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe

MD5 c8202e0619f6d52ee17d804390c7e69e
SHA1 1440fce3cea3e1359f228ffda1623485277ac3d3
SHA256 db8f4538bc51a62bc472d6ab184f0312ee6629c356a27f362972b29f5c567f2e
SHA512 80dc1da98ebe0c970b3715e6457003830c8a770fe2015536351a85ce033bd94ca090c2e3fdd717900cb4bd4756c15fd28df8021507218485ee3044b1df8f8bea

memory/2764-32-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2764-31-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2764-29-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2764-33-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2764-38-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2064-35-0x0000000000F60000-0x0000000001078000-memory.dmp

memory/2764-39-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2064-40-0x000000001BF70000-0x000000001C04E000-memory.dmp

\Users\Admin\AppData\Local\Temp\Costura\A29D0C93F8993C14FEDF5A09E86327D8\64\hook.dll

MD5 c94285ebdfa20d85dbc9cdf33ba0490b
SHA1 4dbe184b5f963fc90d970fd1b1fe7a5fb90d1461
SHA256 c5544b88b1ebe92bf2a673a36e207399edfb9451c454996934aa2d65601066d1
SHA512 0c3e4fba470b770fffae68132a8172f9c4196c6cfbd93c2df7caa9b8472a877e2a36c7d40fb69a5d8d3f44cedd079af9c131b699864be721f5f37036822f1b59

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 3b26f84afa6d3a94324280c8536eb683
SHA1 ba4816234dbdf82e4adb8067380192858135d281
SHA256 420d52c1e4beb7daa73f07d44a750437b4f27daff6b447f26112b89c3e1fb041
SHA512 4c5811e22acc8a87089c6d2feeb60cb967f8531b3d12a41f82439ec6a9692b4bb33f7d28bca6460ba1e7891bb50d83be961fe1d5025795e9d7ef0d34245ad9f0

memory/2064-79-0x00000000008F0000-0x00000000008FA000-memory.dmp

memory/2064-78-0x00000000008F0000-0x00000000008FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab23D8.tmp

MD5 2d3dcf90f6c99f47e7593ea250c9e749
SHA1 51be82be4a272669983313565b4940d4b1385237
SHA256 8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA512 9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

memory/2064-102-0x00000000008F0000-0x00000000008FA000-memory.dmp

memory/2064-101-0x00000000008F0000-0x00000000008FA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 17:09

Reported

2024-06-25 17:11

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\HD_0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 448 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 448 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 448 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 5100 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 5100 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 5100 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 1172 wrote to memory of 2084 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1172 wrote to memory of 2084 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1172 wrote to memory of 2084 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 448 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\HD_0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe
PID 448 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe C:\Users\Admin\AppData\Local\Temp\HD_0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe
PID 3452 wrote to memory of 4780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3452 wrote to memory of 4780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3452 wrote to memory of 4780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe

"C:\Users\Admin\AppData\Local\Temp\0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe

C:\Users\Admin\AppData\Local\Temp\HD_0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 api1.rocokl.me udp
US 8.8.8.8:53 note.youdao.com udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp

Files

C:\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/5100-4-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/5100-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/5100-10-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/5100-6-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1172-15-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1172-16-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1172-17-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1172-23-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_0a27ad54013313a7aeeedcc5596c0c4b66deca1e12ac8e0c010bbb60360d7cc0.exe

MD5 c8202e0619f6d52ee17d804390c7e69e
SHA1 1440fce3cea3e1359f228ffda1623485277ac3d3
SHA256 db8f4538bc51a62bc472d6ab184f0312ee6629c356a27f362972b29f5c567f2e
SHA512 80dc1da98ebe0c970b3715e6457003830c8a770fe2015536351a85ce033bd94ca090c2e3fdd717900cb4bd4756c15fd28df8021507218485ee3044b1df8f8bea

memory/2988-31-0x00007FF8B1F83000-0x00007FF8B1F85000-memory.dmp

memory/2988-33-0x0000019C4B930000-0x0000019C4BA48000-memory.dmp

memory/2084-37-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2084-34-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2084-30-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2084-27-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1172-13-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2988-38-0x0000019C65F30000-0x0000019C6600E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Costura\A29D0C93F8993C14FEDF5A09E86327D8\64\hook.dll

MD5 c94285ebdfa20d85dbc9cdf33ba0490b
SHA1 4dbe184b5f963fc90d970fd1b1fe7a5fb90d1461
SHA256 c5544b88b1ebe92bf2a673a36e207399edfb9451c454996934aa2d65601066d1
SHA512 0c3e4fba470b770fffae68132a8172f9c4196c6cfbd93c2df7caa9b8472a877e2a36c7d40fb69a5d8d3f44cedd079af9c131b699864be721f5f37036822f1b59

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 3b26f84afa6d3a94324280c8536eb683
SHA1 ba4816234dbdf82e4adb8067380192858135d281
SHA256 420d52c1e4beb7daa73f07d44a750437b4f27daff6b447f26112b89c3e1fb041
SHA512 4c5811e22acc8a87089c6d2feeb60cb967f8531b3d12a41f82439ec6a9692b4bb33f7d28bca6460ba1e7891bb50d83be961fe1d5025795e9d7ef0d34245ad9f0

memory/2988-95-0x00007FF8B1F83000-0x00007FF8B1F85000-memory.dmp

memory/2988-96-0x0000019C69EC0000-0x0000019C69EC8000-memory.dmp

memory/2988-97-0x0000019C6A3A0000-0x0000019C6A3D8000-memory.dmp

memory/2988-98-0x0000019C6A370000-0x0000019C6A37E000-memory.dmp