Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 04:26
Static task
static1
Behavioral task
behavioral1
Sample
257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe
Resource
win7-20240611-en
General
-
Target
257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe
-
Size
1.3MB
-
MD5
0d69b647692da3bd782d0acf83ea4942
-
SHA1
eedb363f39404aef3e836f55db01000a75f5298c
-
SHA256
257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273
-
SHA512
026fe5f2a19e46849f8bc31b5b6b8fe73b90492e932dfeba04ced858f8d11bc8132a34fa5d9cde829417d2d6ec7fc38017330cd2bddace676115876a45e0f0e7
-
SSDEEP
24576:wQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVisaNd:wQZAdVyVT9n/Gg0P+WhoTjd
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4100-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4100-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4100-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3476-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3476-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3476-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3476-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1892-38-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1892-42-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1892-25-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1892-45-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4100-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 13 IoCs
Processes:
resource yara_rule behavioral2/memory/4100-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4100-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4100-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3476-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3476-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3476-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3476-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat C:\Windows\SysWOW64\240598843.txt family_gh0strat behavioral2/memory/1892-38-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1892-42-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1892-25-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1892-45-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4100-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240598843.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 5 IoCs
Processes:
svchost.exeTXPlatforn.exeTXPlatforn.exesvchos.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 4100 svchost.exe 3476 TXPlatforn.exe 1892 TXPlatforn.exe 2064 svchos.exe 4316 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 3 IoCs
Processes:
svchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2064 svchos.exe 3864 svchost.exe 4316 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral2/memory/4100-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4100-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4100-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4100-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3476-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3476-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3476-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3476-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3476-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1892-38-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1892-42-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1892-25-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1892-45-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4100-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchost.exesvchos.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\240598843.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe -
Drops file in Program Files directory 5 IoCs
Processes:
257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exepid process 3472 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe 3472 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 1892 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 4100 svchost.exe Token: SeLoadDriverPrivilege 1892 TXPlatforn.exe Token: 33 1892 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 1892 TXPlatforn.exe Token: 33 1892 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 1892 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exepid process 3472 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe 3472 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exesvchost.exeTXPlatforn.execmd.exesvchost.exedescription pid process target process PID 3472 wrote to memory of 4100 3472 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchost.exe PID 3472 wrote to memory of 4100 3472 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchost.exe PID 3472 wrote to memory of 4100 3472 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchost.exe PID 4100 wrote to memory of 4136 4100 svchost.exe cmd.exe PID 4100 wrote to memory of 4136 4100 svchost.exe cmd.exe PID 4100 wrote to memory of 4136 4100 svchost.exe cmd.exe PID 3476 wrote to memory of 1892 3476 TXPlatforn.exe TXPlatforn.exe PID 3476 wrote to memory of 1892 3476 TXPlatforn.exe TXPlatforn.exe PID 3476 wrote to memory of 1892 3476 TXPlatforn.exe TXPlatforn.exe PID 3472 wrote to memory of 2064 3472 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchos.exe PID 3472 wrote to memory of 2064 3472 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchos.exe PID 3472 wrote to memory of 2064 3472 257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe svchos.exe PID 4136 wrote to memory of 3212 4136 cmd.exe PING.EXE PID 4136 wrote to memory of 3212 4136 cmd.exe PING.EXE PID 4136 wrote to memory of 3212 4136 cmd.exe PING.EXE PID 3864 wrote to memory of 4316 3864 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 3864 wrote to memory of 4316 3864 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 3864 wrote to memory of 4316 3864 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe"C:\Users\Admin\AppData\Local\Temp\257890ed2552fa07acef6118fceb746cc79dd85f0a16c42b76e004758ac0f273.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240598843.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.3MB
MD5fe4b38415fbf4013f0f3fd465e260824
SHA1ad68933c34bcfa10112616de4b796dd7bf1dbb47
SHA2569305ea27a633bc3394da979d94e7d59360f815e737afe431bd32555e5dcc3db5
SHA5122f3f7351b923aa470a0bfc1aa6c53f8fe4a2cad81c82e0e6cb28c7d911ce2c61fcb16dc5e72867ff46040e4b21b70c294a1c51262312d25b6f45e17ef4480560
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
C:\Windows\SysWOW64\240598843.txtFilesize
50KB
MD510f25f344effd107f611ecc228f48bd7
SHA1062b579fa982b37ac4ac9612da55e7f206251e72
SHA256aec4296d16d22af47788d1244689992573b3dfed8ae8a6220ac2ae288e6561fc
SHA5121249608f653f91ddb83b8a35d5be9441890e257ea282a6443125686c44fdad2f4ea716e69d92e1adaadb0a3a2d04ed74f7c8df7c269513faa49ef4f384ef911f
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
memory/1892-45-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1892-25-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1892-42-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1892-38-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3476-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3476-29-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3476-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3476-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3476-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4100-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4100-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4100-19-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4100-10-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4100-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB