Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 10:49
Static task
static1
Behavioral task
behavioral1
Sample
3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe
Resource
win7-20240903-en
General
-
Target
3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe
-
Size
2.4MB
-
MD5
16d4208183379a123eed0b295a6c56e0
-
SHA1
1b0ea2d0390ef26c50d085aa044075d263b2b51a
-
SHA256
3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3
-
SHA512
deecc48f1f0547588eeff40bc77124cb888296e97c873b326c816431ed064fbfda62db6c24cd8eed25dcebf1a786a3413a315cbaa9fb269e0a39cbfbc32c4d69
-
SSDEEP
49152:VQZAdVyVT9n/Gg0P+WhoqJlxAibBEZ1LWtBzkOm:OGdVyVT9nOgmhRlZOAC
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4288-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4288-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4288-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2484-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2484-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2484-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1108-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2484-30-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1108-86-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1108-89-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1108-91-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 12 IoCs
resource yara_rule behavioral2/memory/4288-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4288-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4288-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2484-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2484-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2484-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1108-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/files/0x0007000000023c98-36.dat family_gh0strat behavioral2/memory/2484-30-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1108-86-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1108-89-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1108-91-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240630375.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
pid Process 4288 svchost.exe 2484 TXPlatforn.exe 1108 TXPlatforn.exe 3468 svchos.exe 1576 HD_3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe 4024 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 3 IoCs
pid Process 3468 svchos.exe 1912 svchost.exe 4024 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\240630375.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe -
resource yara_rule behavioral2/memory/4288-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4288-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4288-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4288-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2484-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2484-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2484-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1108-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2484-30-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2484-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1108-86-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1108-89-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1108-91-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXPlatforn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3872 cmd.exe 3092 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3092 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1096 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe 1096 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1108 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4288 svchost.exe Token: SeLoadDriverPrivilege 1108 TXPlatforn.exe Token: 33 1108 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 1108 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1096 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe 1096 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1096 wrote to memory of 4288 1096 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe 84 PID 1096 wrote to memory of 4288 1096 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe 84 PID 1096 wrote to memory of 4288 1096 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe 84 PID 4288 wrote to memory of 3872 4288 svchost.exe 87 PID 4288 wrote to memory of 3872 4288 svchost.exe 87 PID 4288 wrote to memory of 3872 4288 svchost.exe 87 PID 2484 wrote to memory of 1108 2484 TXPlatforn.exe 88 PID 2484 wrote to memory of 1108 2484 TXPlatforn.exe 88 PID 2484 wrote to memory of 1108 2484 TXPlatforn.exe 88 PID 1096 wrote to memory of 3468 1096 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe 90 PID 1096 wrote to memory of 3468 1096 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe 90 PID 1096 wrote to memory of 3468 1096 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe 90 PID 1096 wrote to memory of 1576 1096 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe 93 PID 1096 wrote to memory of 1576 1096 3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe 93 PID 3872 wrote to memory of 3092 3872 cmd.exe 94 PID 3872 wrote to memory of 3092 3872 cmd.exe 94 PID 3872 wrote to memory of 3092 3872 cmd.exe 94 PID 1912 wrote to memory of 4024 1912 svchost.exe 101 PID 1912 wrote to memory of 4024 1912 svchost.exe 101 PID 1912 wrote to memory of 4024 1912 svchost.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe"C:\Users\Admin\AppData\Local\Temp\3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3092
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3468
-
-
C:\Users\Admin\AppData\Local\Temp\HD_3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exeC:\Users\Admin\AppData\Local\Temp\HD_3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe2⤵
- Executes dropped EXE
PID:1576
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1108
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵PID:2388
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240630375.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4024
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_3e55a61f69c021b17bdc804b63f7825e1cc12d5a7552fbf2182bb4db07d582e3N.exe
Filesize966KB
MD53740507a1dc4ff4cb5c6e52652c10c20
SHA1b2c8a0a736fe81c101f4ab4cd6be8099c3f902b3
SHA2566a72cc8649a63b017844c4c1f3885a250d1a982ffe5f1e58b6f1432fe9198e62
SHA512d5299859a6121c6ae5813be61648ca1f005970ebe34a8217d05b570ffbd4651f64ad7b3a7bf5129e708e07b36e097333f754b213e73d5fe9246347afd8fa3c22
-
Filesize
1.5MB
MD59e90ceaa96b1c33706d0dea5e7185058
SHA184eb303c0aa8711d65e3cdb71e7e7f16066c6118
SHA2565e42bc3cd8e04234797c9e6342526a43536ddeea9b60570a22aecf131dbbe92e
SHA512fef1c282e808e57cce490f38449615e9eb66c5315febff51ff04d25b6c7b95aec85666c89461908a7969843facd501d0ff2efe8d09ff3228cc67645949400a04
-
Filesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
Filesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
Filesize
50KB
MD5e76d479fcd720b00ac0aa7b38da629e5
SHA1b37e3e63b0717c2a0da10f5a0e3b7f335a871d62
SHA256c4dca89cc9f44a14814740a37c7c0ce590d39efee756212d695c24010c126980
SHA512bb5f39513931a992cca226349d3664ea31b63dc0a64c788b25c5f1a1a43a68e70d59a48214c3643e1a5ebc8573a272ece1e746f8615e05f657778b5c26f08371
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641