Analysis
-
max time kernel
160s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 18:17
Static task
static1
Behavioral task
behavioral1
Sample
eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe
Resource
win7-20240221-en
General
-
Target
eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe
-
Size
1.6MB
-
MD5
bf8f75f265b954f97af423098add60f5
-
SHA1
7ed89801b659b8046b8f867ab562c9d3d58caa5d
-
SHA256
eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194
-
SHA512
4385e21c5ea39ce975b4658018217bf164af0475b018418886b03b94abd433041a01add8266d9dfdcb8c780d5109637967eb5d8501b31247892a2d36acceb508
-
SSDEEP
49152:PxZAdVyVT9n/Gg0P+WhoinBTFKu3p57Dmn2V:JGdVyVT9nOgmhVBv5Dmn2V
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2320-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2320-14-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2320-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4456-24-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4456-23-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4456-25-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4456-38-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2320-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4352-39-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4352-42-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4352-44-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 12 IoCs
resource yara_rule behavioral2/memory/2320-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/files/0x0007000000023273-12.dat family_gh0strat behavioral2/memory/2320-14-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2320-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4456-24-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4456-23-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4456-25-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4456-38-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2320-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4352-39-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4352-42-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4352-44-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240663656.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 5 IoCs
pid Process 2320 svchost.exe 1096 svchos.exe 4456 TXPlatforn.exe 4352 TXPlatforn.exe 3024 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 3 IoCs
pid Process 1096 svchos.exe 864 svchost.exe 3024 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
resource yara_rule behavioral2/memory/2320-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2320-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2320-14-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2320-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4456-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4456-24-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4456-23-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4456-25-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4456-38-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2320-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4352-39-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4352-42-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4352-44-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\240663656.txt svchos.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 696 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4964 eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe 4964 eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4352 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2320 svchost.exe Token: SeLoadDriverPrivilege 4352 TXPlatforn.exe Token: 33 4352 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4352 TXPlatforn.exe Token: 33 4352 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4352 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4964 eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe 4964 eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4964 wrote to memory of 2320 4964 eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe 89 PID 4964 wrote to memory of 2320 4964 eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe 89 PID 4964 wrote to memory of 2320 4964 eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe 89 PID 4964 wrote to memory of 1096 4964 eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe 90 PID 4964 wrote to memory of 1096 4964 eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe 90 PID 4964 wrote to memory of 1096 4964 eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe 90 PID 2320 wrote to memory of 1484 2320 svchost.exe 92 PID 2320 wrote to memory of 1484 2320 svchost.exe 92 PID 2320 wrote to memory of 1484 2320 svchost.exe 92 PID 1484 wrote to memory of 696 1484 cmd.exe 96 PID 1484 wrote to memory of 696 1484 cmd.exe 96 PID 1484 wrote to memory of 696 1484 cmd.exe 96 PID 4456 wrote to memory of 4352 4456 TXPlatforn.exe 97 PID 4456 wrote to memory of 4352 4456 TXPlatforn.exe 97 PID 4456 wrote to memory of 4352 4456 TXPlatforn.exe 97 PID 864 wrote to memory of 3024 864 svchost.exe 98 PID 864 wrote to memory of 3024 864 svchost.exe 98 PID 864 wrote to memory of 3024 864 svchost.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe"C:\Users\Admin\AppData\Local\Temp\eba1137a73bd552cf2b3d322d6263ec1673ac511b0f0053c7fb81933ca06b194.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:696
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1096
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4352
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵PID:4420
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240663656.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵PID:2760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD56b58388c325ba680c4d38e25c5a89f18
SHA1017282779e3253f17424fc8dfb0eacee5ed2b95c
SHA25695bf223da8626c425ebfa8f05edd57af6778d80ec674dad402f785fe6bca9bd6
SHA512fc869d49c8f0a04698edb62f421ca802be1216b65bd8404d91b857111239529011659da0cd4e210b53e762143aee1ec9f0d785620ea63d9ba0e09758bb73d982
-
Filesize
1.5MB
MD5c5cc617fcc8c8de962d9a1dc623b59fb
SHA152050c6564106ab325b1077ad78a9ea5b776307e
SHA256d33cde822d2c70ab46d409f803fdf178b6cd524c5f4250fe47bb51fa140173a6
SHA512e23e3a5cc2ed20ffd0bfe2b5bd51d992066dfbb1636261d5781f8db8b723f8e333c160fbdb84563a62d6a8289504143b793468c874ba180e370ecfc41e7ed8c8
-
Filesize
69KB
MD5e33fb6d686b1a8b171349572c5a33f67
SHA129f24fe536adf799b69b63c83efadc1bce457a54
SHA256020c8e0963f89f4b14538b7d69e83c6fec44a29bbbd52fbb6deb2be5c697f450
SHA512cf1f1d6a9efe53f84e5b4a8246b87c0b96496716605d1b00352d9aae30e664d3d2cbadebf598b4e690a9feef0b5785887a4e643cc5f68938ca744af1d3539e55
-
Filesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
Filesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
Filesize
50KB
MD5d0c5eda6b61a66e79e40e542029b3cc2
SHA1b8c2e90fc407fa3ea4888aeff2256f4247f231d1
SHA256db2451a9270518ecacbd9da070e919a31ab5b4b6e9c50ed8a9f626a3f1af40f8
SHA512d51b7f827c924b8a5dd74c212fab1f648533b84cd329a99f73d7e792ccb703882045695ff61f43c95acaa74805bed35eaf51d4247e7921c13e911beeae90b4ec
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641