Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
05-12-2024 05:23
Static task
static1
Behavioral task
behavioral1
Sample
2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe
Resource
win7-20240708-en
General
-
Target
2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe
-
Size
1.9MB
-
MD5
1839fef2a1f18e3a72b8c67e735cd908
-
SHA1
51ff38c8b5520912bf43949d1800a1e08fb4b021
-
SHA256
2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924
-
SHA512
42963c62ca270a04af2841b486255e7635c9e1596ea398ca51cb6134537b044156d71061dc71926d1b43a96f81fb580585556e97e24feff41deffaa0f7d3bf69
-
SSDEEP
49152:QQZAdVyVT9n/Gg0P+Who9fzImcLYFpeapelE:5GdVyVT9nOgmhAfSFvlE
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2856-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2856-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2856-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2220-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2832-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2832-40-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2832-68-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2832-33-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2220-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 10 IoCs
resource yara_rule behavioral1/memory/2856-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2856-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2856-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2220-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2832-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2832-40-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2832-68-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/files/0x000700000001907c-34.dat family_gh0strat behavioral1/memory/2832-33-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2220-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 5 IoCs
pid Process 2856 svchost.exe 2220 TXPlatforn.exe 2832 TXPlatforn.exe 2700 svchos.exe 2604 HD_2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe -
Loads dropped DLL 4 IoCs
pid Process 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe 2220 TXPlatforn.exe 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe 2700 svchos.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\259458632.txt svchos.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe -
resource yara_rule behavioral1/memory/2856-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2856-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2856-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2856-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2220-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2832-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2832-40-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2832-68-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2832-33-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2220-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXPlatforn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3052 PING.EXE 2764 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3052 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2832 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2856 svchost.exe Token: SeLoadDriverPrivilege 2832 TXPlatforn.exe Token: 33 2832 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2832 TXPlatforn.exe Token: 33 2832 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2832 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2856 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe 30 PID 2084 wrote to memory of 2856 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe 30 PID 2084 wrote to memory of 2856 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe 30 PID 2084 wrote to memory of 2856 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe 30 PID 2084 wrote to memory of 2856 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe 30 PID 2084 wrote to memory of 2856 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe 30 PID 2084 wrote to memory of 2856 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe 30 PID 2856 wrote to memory of 2764 2856 svchost.exe 32 PID 2856 wrote to memory of 2764 2856 svchost.exe 32 PID 2856 wrote to memory of 2764 2856 svchost.exe 32 PID 2856 wrote to memory of 2764 2856 svchost.exe 32 PID 2220 wrote to memory of 2832 2220 TXPlatforn.exe 33 PID 2220 wrote to memory of 2832 2220 TXPlatforn.exe 33 PID 2220 wrote to memory of 2832 2220 TXPlatforn.exe 33 PID 2220 wrote to memory of 2832 2220 TXPlatforn.exe 33 PID 2220 wrote to memory of 2832 2220 TXPlatforn.exe 33 PID 2220 wrote to memory of 2832 2220 TXPlatforn.exe 33 PID 2220 wrote to memory of 2832 2220 TXPlatforn.exe 33 PID 2084 wrote to memory of 2700 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe 34 PID 2084 wrote to memory of 2700 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe 34 PID 2084 wrote to memory of 2700 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe 34 PID 2084 wrote to memory of 2700 2084 2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe 34 PID 2764 wrote to memory of 3052 2764 cmd.exe 37 PID 2764 wrote to memory of 3052 2764 cmd.exe 37 PID 2764 wrote to memory of 3052 2764 cmd.exe 37 PID 2764 wrote to memory of 3052 2764 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe"C:\Users\Admin\AppData\Local\Temp\2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3052
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2700
-
-
C:\Users\Admin\AppData\Local\Temp\HD_2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exeC:\Users\Admin\AppData\Local\Temp\HD_2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe2⤵
- Executes dropped EXE
PID:2604
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_2937dc0acfdba23157b87670796e9db8458e318b9316a53127946f02ca7af924.exe
Filesize655KB
MD5470443e44566ecfc7ac2ddbec240a73f
SHA127bb8d2fc02cd2bbc184d07357aaa9903d88b425
SHA256006652da0745d8672ec56598368c1f8a4896cd4a0aa5b61499d574870f94b705
SHA51222c9bc36874abb015a7e1a28e26f186f2abbd559aad53fdcf493f2178dbc6cfe5a7324d0acadcf4a641028e61787d2f4237a8c034a3a7a6d0a7162f31e05a618
-
Filesize
1.3MB
MD5696a7236e14e7407b5023681fba1d690
SHA143c550a8ab63b5f5a2a2622e5f614c4aaeeaf78e
SHA256af034321362311726b4f39f658d691b7cf2ddf6eccd13f771532abde387f720a
SHA5124582231dde50799d1925ba884e6e9d4bfde0a7ca56ee0f9d7bb0ccea18cbb73bda8bdf4de387537ade3d0be5c496f5748346c91806da72f7bf2e0fd814a6d0a0
-
Filesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
Filesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
Filesize
50KB
MD543eb1f8fcb6e8d45d10a1acaaef5d6a5
SHA175d2b751caf82e13a3e1aa4f8addc8ece42ddc5a
SHA256090705e83dfffbb815219fdf99a3e9edf92562c7e7790f4f67cb430ec4c519a9
SHA512db5988709603e86fc27ab7397f9ba3f61c4f897a4b149e64b77d94e403bde149380b746b0aad2a3219ca67a1373bf476da83e03f807e8e06364affa85ce38aed