Malware Analysis Report

2025-04-13 21:02

Sample ID 250102-tnnjlsxpdz
Target 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50
SHA256 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50
Tags
xred gh0strat purplefox backdoor discovery macro persistence rat rootkit trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50

Threat Level: Known bad

The file 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50 was found to be: Known bad.

Malicious Activity Summary

xred gh0strat purplefox backdoor discovery macro persistence rat rootkit trojan upx

Detect PurpleFox Rootkit

Gh0st RAT payload

Xred

Xred family

Gh0strat family

Gh0strat

PurpleFox

Purplefox family

Suspicious Office macro

Sets service image path in registry

Drops file in Drivers directory

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

UPX packed file

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Suspicious behavior: AddClipboardFormatListener

Enumerates system info in registry

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Runs ping.exe

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-02 16:12

Signatures

Xred family

xred

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-02 16:12

Reported

2025-01-02 16:14

Platform

win7-20240903-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

PurpleFox

rootkit trojan purplefox

Purplefox family

purplefox

Xred

backdoor xred

Xred family

xred

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TXPlatforn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2776 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2776 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2776 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2776 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2776 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2776 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2776 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2816 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2808 wrote to memory of 2572 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2808 wrote to memory of 2572 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2808 wrote to memory of 2572 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2808 wrote to memory of 2572 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2808 wrote to memory of 2572 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2808 wrote to memory of 2572 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2808 wrote to memory of 2572 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 2776 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2776 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2776 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2776 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2064 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2064 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2064 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2064 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2664 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2664 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2664 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2664 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 2664 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2664 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2664 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2664 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1588 wrote to memory of 532 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1588 wrote to memory of 532 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1588 wrote to memory of 532 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1588 wrote to memory of 532 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

"C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 8.8.8.8:53 docs.google.com udp
FR 216.58.214.174:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
FR 142.250.74.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 88.221.134.83:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp

Files

\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/2816-5-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2816-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2816-12-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2816-8-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

MD5 db06bd4b57933fb4dd26188ab9a013c7
SHA1 24fb49c4fbe2993e96595d1085dbae18d8a73db4
SHA256 5d3ccb3cf874eed6dabe680217d17a22096711ddfe184ecb825cf66b46837600
SHA512 cd20b5a3abc4b649ae490553e8ef4973a25b77cc6fc669f096928737eec359fdb53e00985314f14f94d3598bebf119ac17c760ece3cb45a0a56bc36c3521a784

memory/2808-29-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 43a309d76c3bb4a91e3d464b2adb1a70
SHA1 d12fc070e16edf51a1dbe8621fd3e1b2c4be60d3
SHA256 10801369a0b307d0b9abf07dab6a92263b7c66fa6fc66bb6d0c86260d2fba649
SHA512 6925d0cc83c2d8ca52fa58d49d98e94b667ec68d6e2de68d6bf3f3a406bc027a2db7f1aa3e5f4b13c84503d488b9d7392fcaf61e548dc27ddb102e45d327b9c4

memory/2572-37-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2572-36-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2572-34-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2572-72-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2572-70-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

MD5 fd5137d1998bf8fcbab832123dd72256
SHA1 155e5dd08ecbe6483167f596c927208f4cca8a39
SHA256 86ee28923d4e7255762442fe93f220237197a756182ce320f5f6887b5c7147c5
SHA512 fd9270902cec43a84048a0e90ded14e56c9bae46ef067081d10784c82ec1a0ef7dc605b11d8819c9c5d75dea342df8a419bdd61f8ef7411c25fee932038ea465

memory/2572-75-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2664-101-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/1780-112-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\shXR11yC.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

memory/1780-118-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-126-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-125-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-124-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-122-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-120-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-117-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-115-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-123-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-121-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-119-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-116-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-129-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-138-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-137-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-136-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-134-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-133-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-131-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-135-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-128-0x0000000000530000-0x0000000000630000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\shXR11yC.xlsm

MD5 20ce3abe8f903992e7589b6b3237e429
SHA1 9e3445e1930e59f93e833046485d68d0adfdcf07
SHA256 8289c8e41c3cfafe03f8e041f78c2b8cd316c635434a09de6bb88c73c2f21c63
SHA512 e1c858f3b9226ba5d8e883ce5c8a20c5936451a461a7c24ffc09246c34db3c5e0047592a9efe1741bc7bcfd424278d9068790b1851470a8e21e2fad02145b2ad

memory/1780-132-0x0000000000530000-0x0000000000630000-memory.dmp

memory/1780-127-0x0000000000530000-0x0000000000630000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\shXR11yC.xlsm

MD5 417d0181cf991fd6a706b4b29ba50a6d
SHA1 3a73f6fa3ed64989d891b2eeeaccb6b11c02a89e
SHA256 631e46f2cd6c097142c76e20bdd80879108218380d10698132547397a67041bc
SHA512 adfe038ab9deb7080251d34b9308bfe00471a67638b5a7f6c9dec6d6f386b7bce765f01b7fec54ab1c5348187041dddf0d22d7e0f6c4b17dcac9358aadff109a

C:\Users\Admin\AppData\Local\Temp\shXR11yC.xlsm

MD5 09353ea8e5ca14c637e1c6aec099e92e
SHA1 aa1c85f33793f6231412b19ad776347231463e14
SHA256 b75bcfd3824bd2a03a4218ce2149b9a0e6da9511f9a9630bb42b6dbe766766dc
SHA512 964e5170c9fd509252e2925cc3fd84b1ea06b9cb52273e4affd09fd1a0a22c7954c9b96d5d97903b784b39b618bb2332c3e0fa734e66aeb370bf9549b1f6d2e5

memory/1780-130-0x0000000000530000-0x0000000000630000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\shXR11yC.xlsm

MD5 66973a669370a7755443735dc922b08f
SHA1 b35339ab698fb5ce976bbc5ab767264cc95ebd08
SHA256 7749e8696b3732253dffae21c928227254f9b5b5b4a9305a8006fc25ce11b805
SHA512 adc1aac6cfee5f155bc72a603369b929bebb060e3b2f685d57bf694190982c01facd1a7ddc9a52303013f304fe459e5a584af05f10304b5bb839f4893d6d7f25

C:\Users\Admin\AppData\Local\Temp\shXR11yC.xlsm

MD5 5ea291c1a5890f888b20df62fb8c364d
SHA1 1bad63e61cb8e4df6ba463ff2e8fea1cf65f0a32
SHA256 1e6ed2f4d0484fc5fe34dc3deb522a127dcdaae0b6c047ae1c098f851410d298
SHA512 374e00367a80e9290731b95391ce157519f482ccdc888046177bf6028acb208c74695c77e8153f145588c70a1fa9fd4f8c8b8a27ab76c2712b1685d9128db8e6

C:\Users\Admin\Desktop\~$ConvertFromExpand.xlsx

MD5 ff09371174f7c701e75f357a187c06e8
SHA1 57f9a638fd652922d7eb23236c80055a91724503
SHA256 e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512 e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882

memory/1780-210-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\shXR11yC.xlsm

MD5 15e176cb4a35320314790087b0d97bfa
SHA1 232b4d0319a9faf9a4f60f754a61c8e46cbb81e1
SHA256 986692be586b758ba71b75e4572887dd7a74155671db80831a3c9ecce03e700d
SHA512 10874f32c93bfe50a3b864ca1780f4c218dd96c6afaa4d084f8ee0c709738520c7042ec3411a0c5f7decb29e43c2b4e7e9c8ca24c03f2e7af14e51b6503d9239

memory/1588-211-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/1588-251-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/1588-267-0x0000000000400000-0x00000000004D9000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-02 16:12

Reported

2025-01-02 16:14

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

PurpleFox

rootkit trojan purplefox

Purplefox family

purplefox

Xred

backdoor xred

Xred family

xred

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\TXPlatforn.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\TXPlatforn.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\ProgramData\Synaptics\Synaptics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\TXPlatforn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\ProgramData\Synaptics\Synaptics.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\TXPlatforn.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3064 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 3064 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 3064 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\RVN.exe
PID 2564 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2564 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 2564 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\RVN.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 3064 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 3064 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 1708 wrote to memory of 2008 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1708 wrote to memory of 2008 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1708 wrote to memory of 2008 N/A C:\Windows\SysWOW64\TXPlatforn.exe C:\Windows\SysWOW64\TXPlatforn.exe
PID 1060 wrote to memory of 2984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1060 wrote to memory of 2984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1060 wrote to memory of 2984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1644 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 1644 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 1644 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
PID 1644 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1644 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1644 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 1148 wrote to memory of 2188 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1148 wrote to memory of 2188 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1148 wrote to memory of 2188 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

"C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"

C:\Users\Admin\AppData\Local\Temp\RVN.exe

C:\Users\Admin\AppData\Local\Temp\\RVN.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul

C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

C:\Windows\SysWOW64\TXPlatforn.exe

C:\Windows\SysWOW64\TXPlatforn.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 252.215.42.69.in-addr.arpa udp
US 8.8.8.8:53 26.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 182.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 docs.google.com udp
FR 216.58.214.174:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.250.179.67:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
FR 142.250.179.67:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
FR 142.250.74.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 174.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 67.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 225.74.250.142.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 85.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp
US 8.8.8.8:53 hackerinvasion.f3322.net udp

Files

C:\Users\Admin\AppData\Local\Temp\RVN.exe

MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

memory/2564-6-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2564-4-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2564-10-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2564-7-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1708-15-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1708-17-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1708-16-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1708-13-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/1708-24-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

MD5 db06bd4b57933fb4dd26188ab9a013c7
SHA1 24fb49c4fbe2993e96595d1085dbae18d8a73db4
SHA256 5d3ccb3cf874eed6dabe680217d17a22096711ddfe184ecb825cf66b46837600
SHA512 cd20b5a3abc4b649ae490553e8ef4973a25b77cc6fc669f096928737eec359fdb53e00985314f14f94d3598bebf119ac17c760ece3cb45a0a56bc36c3521a784

memory/1644-29-0x0000000002140000-0x0000000002141000-memory.dmp

memory/2008-44-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

MD5 43a309d76c3bb4a91e3d464b2adb1a70
SHA1 d12fc070e16edf51a1dbe8621fd3e1b2c4be60d3
SHA256 10801369a0b307d0b9abf07dab6a92263b7c66fa6fc66bb6d0c86260d2fba649
SHA512 6925d0cc83c2d8ca52fa58d49d98e94b667ec68d6e2de68d6bf3f3a406bc027a2db7f1aa3e5f4b13c84503d488b9d7392fcaf61e548dc27ddb102e45d327b9c4

memory/2008-69-0x0000000010000000-0x00000000101B6000-memory.dmp

memory/2008-80-0x0000000010000000-0x00000000101B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe

MD5 fd5137d1998bf8fcbab832123dd72256
SHA1 155e5dd08ecbe6483167f596c927208f4cca8a39
SHA256 86ee28923d4e7255762442fe93f220237197a756182ce320f5f6887b5c7147c5
SHA512 fd9270902cec43a84048a0e90ded14e56c9bae46ef067081d10784c82ec1a0ef7dc605b11d8819c9c5d75dea342df8a419bdd61f8ef7411c25fee932038ea465

memory/1644-206-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/1148-267-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/3364-268-0x00007FFD784F0000-0x00007FFD78500000-memory.dmp

memory/3364-269-0x00007FFD784F0000-0x00007FFD78500000-memory.dmp

memory/3364-270-0x00007FFD784F0000-0x00007FFD78500000-memory.dmp

memory/3364-271-0x00007FFD784F0000-0x00007FFD78500000-memory.dmp

memory/3364-272-0x00007FFD784F0000-0x00007FFD78500000-memory.dmp

memory/3364-273-0x00007FFD76230000-0x00007FFD76240000-memory.dmp

memory/3364-274-0x00007FFD76230000-0x00007FFD76240000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xk9zRRgk.xlsm

MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

memory/1148-302-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/1148-351-0x0000000000400000-0x00000000004D9000-memory.dmp