resource	yara_rule
behavioral2/memory/3272-19-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3272-20-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3272-23-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2820-28-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2820-29-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/412-40-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/412-37-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/412-45-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

resource	yara_rule
behavioral2/files/0x0007000000023431-5.dat	family_gh0strat
behavioral2/memory/3272-19-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3272-20-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3272-23-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2820-28-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2820-29-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/412-40-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/412-37-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/412-45-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

pid	Process
2848	R.exe
3272	N.exe
2820	TXPlatfor.exe
412	TXPlatfor.exe
2824	HD_3fcccc518e3a1b73be4696d36f2c50765608a6a8b1bf64b82db35a8b3ead76dd.exe
4668	Remote Data.exe

resource	yara_rule
behavioral2/memory/3272-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3272-19-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3272-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3272-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2820-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2820-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2820-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/412-40-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/412-37-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/412-45-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File created	C:\Windows\SysWOW64\240604250.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe

pid	Process
3500	3fcccc518e3a1b73be4696d36f2c50765608a6a8b1bf64b82db35a8b3ead76dd.exe
3500	3fcccc518e3a1b73be4696d36f2c50765608a6a8b1bf64b82db35a8b3ead76dd.exe

description	pid	Process
Token: SeIncBasePriorityPrivilege	3272	N.exe
Token: SeLoadDriverPrivilege	412	TXPlatfor.exe
Token: 33	412	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	412	TXPlatfor.exe
Token: 33	412	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	412	TXPlatfor.exe

description	pid	Process	procid_target
PID 3500 wrote to memory of 2848	3500	3fcccc518e3a1b73be4696d36f2c50765608a6a8b1bf64b82db35a8b3ead76dd.exe	80
PID 3500 wrote to memory of 2848	3500	3fcccc518e3a1b73be4696d36f2c50765608a6a8b1bf64b82db35a8b3ead76dd.exe	80
PID 3500 wrote to memory of 2848	3500	3fcccc518e3a1b73be4696d36f2c50765608a6a8b1bf64b82db35a8b3ead76dd.exe	80
PID 3500 wrote to memory of 3272	3500	3fcccc518e3a1b73be4696d36f2c50765608a6a8b1bf64b82db35a8b3ead76dd.exe	83
PID 3500 wrote to memory of 3272	3500	3fcccc518e3a1b73be4696d36f2c50765608a6a8b1bf64b82db35a8b3ead76dd.exe	83
PID 3500 wrote to memory of 3272	3500	3fcccc518e3a1b73be4696d36f2c50765608a6a8b1bf64b82db35a8b3ead76dd.exe	83
PID 3272 wrote to memory of 2832	3272	N.exe	85
PID 3272 wrote to memory of 2832	3272	N.exe	85
PID 3272 wrote to memory of 2832	3272	N.exe	85
PID 2820 wrote to memory of 412	2820	TXPlatfor.exe	86
PID 2820 wrote to memory of 412	2820	TXPlatfor.exe	86
PID 2820 wrote to memory of 412	2820	TXPlatfor.exe	86
PID 3500 wrote to memory of 2824	3500	3fcccc518e3a1b73be4696d36f2c50765608a6a8b1bf64b82db35a8b3ead76dd.exe	88
PID 3500 wrote to memory of 2824	3500	3fcccc518e3a1b73be4696d36f2c50765608a6a8b1bf64b82db35a8b3ead76dd.exe	88
PID 2832 wrote to memory of 4476	2832	cmd.exe	89
PID 2832 wrote to memory of 4476	2832	cmd.exe	89
PID 2832 wrote to memory of 4476	2832	cmd.exe	89
PID 720 wrote to memory of 4668	720	svchost.exe	91
PID 720 wrote to memory of 4668	720	svchost.exe	91
PID 720 wrote to memory of 4668	720	svchost.exe	91

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.