Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-08-2024 05:00
Static task
static1
Behavioral task
behavioral1
Sample
0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098.exe
Resource
win7-20240729-en
General
-
Target
0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098.exe
-
Size
1.5MB
-
MD5
d96fe81f0181cd0b8c789989f9be53e7
-
SHA1
d4bfd45cac7c4b494e3dd8fae14337d8c57f382b
-
SHA256
0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098
-
SHA512
7466d5570be4e92b05a390824605df753ca81d85c8699c9aebe040e3389f2c6d948060b0d384b564ec849fc8478760f8ee430af45b4f2232ff9598beec6d7a62
-
SSDEEP
24576:y89tv9/7JtDElDEExIecl1erdg0MCiVWhR/WSNP:y89XJt4HIZ/Gg0P+WhMSNP
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/952-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/952-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/952-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3104-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3104-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3104-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3104-24-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4084-25-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4084-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4084-49-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4084-73-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
resource yara_rule behavioral2/memory/952-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/952-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/952-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3104-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3104-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3104-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3104-24-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4084-25-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4084-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4084-49-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4084-73-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 3 IoCs
pid Process 952 QQ.exe 3104 TXPlatforn.exe 4084 TXPlatforn.exe -
resource yara_rule behavioral2/memory/952-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/952-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/952-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/952-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3104-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3104-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3104-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3104-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3104-24-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4084-25-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4084-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4084-49-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4084-73-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXPlatforn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2356 cmd.exe 4016 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4016 PING.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4084 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 952 QQ.exe Token: SeLoadDriverPrivilege 4084 TXPlatforn.exe Token: 33 4084 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4084 TXPlatforn.exe Token: 33 4084 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 4084 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1540 0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098.exe 1540 0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1540 wrote to memory of 952 1540 0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098.exe 84 PID 1540 wrote to memory of 952 1540 0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098.exe 84 PID 1540 wrote to memory of 952 1540 0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098.exe 84 PID 952 wrote to memory of 2356 952 QQ.exe 86 PID 952 wrote to memory of 2356 952 QQ.exe 86 PID 952 wrote to memory of 2356 952 QQ.exe 86 PID 3104 wrote to memory of 4084 3104 TXPlatforn.exe 87 PID 3104 wrote to memory of 4084 3104 TXPlatforn.exe 87 PID 3104 wrote to memory of 4084 3104 TXPlatforn.exe 87 PID 2356 wrote to memory of 4016 2356 cmd.exe 89 PID 2356 wrote to memory of 4016 2356 cmd.exe 89 PID 2356 wrote to memory of 4016 2356 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098.exe"C:\Users\Admin\AppData\Local\Temp\0cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\QQ.exeC:\Users\Admin\AppData\Local\Temp\\QQ.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\QQ.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4016
-
-
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4084
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5d96fe81f0181cd0b8c789989f9be53e7
SHA1d4bfd45cac7c4b494e3dd8fae14337d8c57f382b
SHA2560cd0e70c3d4270854a28110851dc23970135013e5730520745415e58782f8098
SHA5127466d5570be4e92b05a390824605df753ca81d85c8699c9aebe040e3389f2c6d948060b0d384b564ec849fc8478760f8ee430af45b4f2232ff9598beec6d7a62
-
Filesize
377KB
MD53d6e7db5800f1dadb016cbf989749e3c
SHA17c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA256bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
SHA512a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c