Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 04:26
Static task
static1
Behavioral task
behavioral1
Sample
257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe
Resource
win7-20240611-en
General
-
Target
257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe
-
Size
1.3MB
-
MD5
0d69b647692da3bd782d0acf83ea4942
-
SHA1
eedb363f39404aef3e836f55db01000a75f5298c
-
SHA256
257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273
-
SHA512
026fe5f2a19e46849f8bc31b5b6b8fe73b90492e932dfeba04ced858f8d11bc8132a34fa5d9cde829417d2d6ec7fc38017330cd2bddace676115876a45e0f0e7
-
SSDEEP
24576:wQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVisaNd:wQZAdVyVT9n/Gg0P+WhoTjd
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2620-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2620-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2620-12-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2316-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2456-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2316-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2456-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2456-40-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2456-41-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/2620-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2620-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2620-12-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2316-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2456-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2316-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2456-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat \Windows\SysWOW64\259399086.txt family_gh0strat behavioral1/memory/2456-40-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2456-41-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259399086.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 5 IoCs
Processes:
svchost.exeTXPlatforn.exeTXPlatforn.exesvchos.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2620 svchost.exe 2316 TXPlatforn.exe 2456 TXPlatforn.exe 2792 svchos.exe 1964 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 7 IoCs
Processes:
257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exeTXPlatforn.exesvchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe 2316 TXPlatforn.exe 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe 2792 svchos.exe 1748 svchost.exe 1748 svchost.exe 1964 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral1/memory/2620-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2620-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2620-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2620-12-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2316-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2456-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2316-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2456-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2456-40-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2456-41-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchost.exesvchost.exesvchos.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\259399086.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exepid process 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2456 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2620 svchost.exe Token: SeLoadDriverPrivilege 2456 TXPlatforn.exe Token: 33 2456 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2456 TXPlatforn.exe Token: 33 2456 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2456 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exepid process 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exeTXPlatforn.exesvchost.execmd.exesvchost.exedescription pid process target process PID 2336 wrote to memory of 2620 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchost.exe PID 2336 wrote to memory of 2620 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchost.exe PID 2336 wrote to memory of 2620 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchost.exe PID 2336 wrote to memory of 2620 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchost.exe PID 2336 wrote to memory of 2620 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchost.exe PID 2336 wrote to memory of 2620 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchost.exe PID 2336 wrote to memory of 2620 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchost.exe PID 2316 wrote to memory of 2456 2316 TXPlatforn.exe TXPlatforn.exe PID 2316 wrote to memory of 2456 2316 TXPlatforn.exe TXPlatforn.exe PID 2316 wrote to memory of 2456 2316 TXPlatforn.exe TXPlatforn.exe PID 2316 wrote to memory of 2456 2316 TXPlatforn.exe TXPlatforn.exe PID 2316 wrote to memory of 2456 2316 TXPlatforn.exe TXPlatforn.exe PID 2316 wrote to memory of 2456 2316 TXPlatforn.exe TXPlatforn.exe PID 2316 wrote to memory of 2456 2316 TXPlatforn.exe TXPlatforn.exe PID 2620 wrote to memory of 2328 2620 svchost.exe cmd.exe PID 2620 wrote to memory of 2328 2620 svchost.exe cmd.exe PID 2620 wrote to memory of 2328 2620 svchost.exe cmd.exe PID 2620 wrote to memory of 2328 2620 svchost.exe cmd.exe PID 2336 wrote to memory of 2792 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchos.exe PID 2336 wrote to memory of 2792 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchos.exe PID 2336 wrote to memory of 2792 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchos.exe PID 2336 wrote to memory of 2792 2336 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchos.exe PID 2328 wrote to memory of 2000 2328 cmd.exe PING.EXE PID 2328 wrote to memory of 2000 2328 cmd.exe PING.EXE PID 2328 wrote to memory of 2000 2328 cmd.exe PING.EXE PID 2328 wrote to memory of 2000 2328 cmd.exe PING.EXE PID 1748 wrote to memory of 1964 1748 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 1748 wrote to memory of 1964 1748 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 1748 wrote to memory of 1964 1748 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 1748 wrote to memory of 1964 1748 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe"C:\Users\Admin\AppData\Local\Temp\257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259399086.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.3MB
MD5fe4b38415fbf4013f0f3fd465e260824
SHA1ad68933c34bcfa10112616de4b796dd7bf1dbb47
SHA2569305ea27a633bc3394da979d94e7d59360f815e737afe431bd32555e5dcc3db5
SHA5122f3f7351b923aa470a0bfc1aa6c53f8fe4a2cad81c82e0e6cb28c7d911ce2c61fcb16dc5e72867ff46040e4b21b70c294a1c51262312d25b6f45e17ef4480560
-
\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
\Windows\SysWOW64\259399086.txtFilesize
50KB
MD510f25f344effd107f611ecc228f48bd7
SHA1062b579fa982b37ac4ac9612da55e7f206251e72
SHA256aec4296d16d22af47788d1244689992573b3dfed8ae8a6220ac2ae288e6561fc
SHA5121249608f653f91ddb83b8a35d5be9441890e257ea282a6443125686c44fdad2f4ea716e69d92e1adaadb0a3a2d04ed74f7c8df7c269513faa49ef4f384ef911f
-
\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
memory/2316-31-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2316-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2456-36-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2456-32-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2456-40-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2456-41-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2620-12-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2620-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2620-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2620-5-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB