Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-12-2024 23:23
Static task
static1
Behavioral task
behavioral1
Sample
ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe
Resource
win7-20240903-en
General
-
Target
ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe
-
Size
4.7MB
-
MD5
bd07c770b6187e03782d383618dd3326
-
SHA1
f4b257fa8b3af06c706b0fd019f5e327c4aa52cf
-
SHA256
ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d
-
SHA512
a86f500f58975fb47069c59e2bc60f9b2d486ce18c47b73da908e22ef4fa104faad1c713e0372e142a941fa231b7620bfdb7f285a034ed53ac49ae02863a3a5a
-
SSDEEP
49152:bQZAdVyVT9n/Gg0P+Who2sbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8bU:MGdVyVT9nOgmhWbXsPN5kiQaZ56
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2616-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2616-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2616-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2456-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2456-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2104-35-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2104-38-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2104-45-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
resource yara_rule behavioral1/memory/2616-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2616-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2616-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2456-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2456-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/files/0x0007000000016d58-33.dat family_gh0strat behavioral1/memory/2104-35-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2104-38-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2104-45-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259451237.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
pid Process 2616 svchost.exe 2456 TXPlatforn.exe 2672 svchos.exe 2104 TXPlatforn.exe 2532 HD_ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 572 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 8 IoCs
pid Process 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 2456 TXPlatforn.exe 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 2672 svchos.exe 2720 svchost.exe 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 2720 svchost.exe 572 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\259451237.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe -
resource yara_rule behavioral1/memory/2616-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2616-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2616-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2616-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2456-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2456-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2104-35-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2104-38-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2104-45-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXPlatforn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2260 cmd.exe 2556 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2556 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2104 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2616 svchost.exe Token: SeLoadDriverPrivilege 2104 TXPlatforn.exe Token: 33 2104 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2104 TXPlatforn.exe Token: 33 2104 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2104 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 1088 wrote to memory of 2616 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 31 PID 1088 wrote to memory of 2616 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 31 PID 1088 wrote to memory of 2616 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 31 PID 1088 wrote to memory of 2616 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 31 PID 1088 wrote to memory of 2616 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 31 PID 1088 wrote to memory of 2616 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 31 PID 1088 wrote to memory of 2616 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 31 PID 2616 wrote to memory of 2260 2616 svchost.exe 33 PID 2616 wrote to memory of 2260 2616 svchost.exe 33 PID 2616 wrote to memory of 2260 2616 svchost.exe 33 PID 2616 wrote to memory of 2260 2616 svchost.exe 33 PID 2456 wrote to memory of 2104 2456 TXPlatforn.exe 34 PID 2456 wrote to memory of 2104 2456 TXPlatforn.exe 34 PID 2456 wrote to memory of 2104 2456 TXPlatforn.exe 34 PID 2456 wrote to memory of 2104 2456 TXPlatforn.exe 34 PID 2456 wrote to memory of 2104 2456 TXPlatforn.exe 34 PID 2456 wrote to memory of 2104 2456 TXPlatforn.exe 34 PID 2456 wrote to memory of 2104 2456 TXPlatforn.exe 34 PID 1088 wrote to memory of 2672 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 35 PID 1088 wrote to memory of 2672 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 35 PID 1088 wrote to memory of 2672 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 35 PID 1088 wrote to memory of 2672 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 35 PID 2260 wrote to memory of 2556 2260 cmd.exe 39 PID 2260 wrote to memory of 2556 2260 cmd.exe 39 PID 2260 wrote to memory of 2556 2260 cmd.exe 39 PID 2260 wrote to memory of 2556 2260 cmd.exe 39 PID 1088 wrote to memory of 2532 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 40 PID 1088 wrote to memory of 2532 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 40 PID 1088 wrote to memory of 2532 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 40 PID 1088 wrote to memory of 2532 1088 ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe 40 PID 2720 wrote to memory of 572 2720 svchost.exe 41 PID 2720 wrote to memory of 572 2720 svchost.exe 41 PID 2720 wrote to memory of 572 2720 svchost.exe 41 PID 2720 wrote to memory of 572 2720 svchost.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe"C:\Users\Admin\AppData\Local\Temp\ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2556
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2672
-
-
C:\Users\Admin\AppData\Local\Temp\HD_ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exeC:\Users\Admin\AppData\Local\Temp\HD_ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2532
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵PID:2564
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259451237.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:572
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD58ee704f08e0276d74589f030522bc58c
SHA1703f924eb07068595b58525c036a19b1f61f1076
SHA256ffdbaa78c2f2ff6da683dea1950eae58113f75b0f871f51fda2989f111e07594
SHA512317528fa44235a6e305dcc587fdedac52aafec407e94c20d3390ceb486c3d71158e37add344b39cbc974237b57256f9cb4122dee887fbf560063b50c35cfc2e9
-
Filesize
1.6MB
MD5cdca69366cbe88a76381f8a8849990e8
SHA1ad3a245ff00e13f4525eab19539e96f21304d6e4
SHA2560d50bab03bbb1ac613bee3646df0e2b1c55f7d0003116144a0e0c4f8c384c216
SHA51225e5f210dd6ddded51b46b67f8bc6afdf39c9fb660ed47b1ef0569b130a1b5d132b313624771703bf925b3a3372d27071978915df77d04227ea33c76d6966a61
-
\Users\Admin\AppData\Local\Temp\HD_ba1c6ecaef114fbcc67a39b5f03aba0ac044d4ca3c42eae426e7a06d869a208d.exe
Filesize3.1MB
MD5fb083acd60fe5c3156dc25442be815e3
SHA161df59b8f3ebd8b3d29ca3aedc4995e23cacf6d8
SHA256f130b3789962d5c8b59aa250d6f26ad5945928f3905b32bf65aa7bd30348a794
SHA5127147337d2c1006bb15cfa967c9eea6826b63c8d343f866e7454d7368d25019f39e52cf179500810834244c3ca9644d6c0df0b2c3128a9051e9ee6b428fa926f6
-
Filesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
Filesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
Filesize
50KB
MD51acdeb86981710387f96d0cc4a83b8e5
SHA18c0e1ed9cf7c9dafc207917318609214865923ee
SHA2566018f27db9433a264d0e1c603a94ab80c234efdadddf2f3736c8ee8ae2e841e1
SHA512fba9e9d617eb2b26929be6cacfeae0c92999d8b5dc1b3fd45f2895e606c2f67d42f65a4584f43a3288e0b4fc78f68b2c8910333be75a05af6ee897fc1ea61cf3
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d