Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 04:11
Static task
static1
Behavioral task
behavioral1
Sample
911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe
Resource
win7-20240611-en
General
-
Target
911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe
-
Size
5.9MB
-
MD5
e3a59bd53715e1322cc0822d051bf792
-
SHA1
f2841033a94bba069ed793cbbce955f138ba0b08
-
SHA256
911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32
-
SHA512
0d1bc5e4fe0e8d10c59dcffb9d8a9ebf0372a40b1c4c310bde21bfcd08c090dfca97e2e47f35558af428ca10bd9026d04f830642ae20557cd96b11eba7e440a9
-
SSDEEP
98304:9GdVyVT9nOgmh9Dmn2y6666666666666666666666666666666x6666666666663:aWT9nO73mnlu1vZzdDESxkR2Si/eVhzW
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1452-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1452-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1452-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1192-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1192-26-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1448-38-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1448-42-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1448-48-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1192-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1192-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/1452-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1452-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1452-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1192-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1192-26-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat C:\Windows\SysWOW64\240600343.txt family_gh0strat behavioral2/memory/1448-38-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1448-42-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1448-48-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1448-23-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1192-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1192-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240600343.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
Processes:
svchost.exeTXPlatforn.exeTXPlatforn.exesvchos.exeHD_911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 1452 svchost.exe 1192 TXPlatforn.exe 1448 TXPlatforn.exe 1632 svchos.exe 2440 HD_911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe 1232 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 3 IoCs
Processes:
svchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 1632 svchos.exe 3620 svchost.exe 1232 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral2/memory/1452-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1452-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1452-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1452-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1192-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1192-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1192-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1448-38-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1448-42-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1448-48-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1448-23-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1192-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1192-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchost.exesvchos.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\240600343.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe -
Drops file in Program Files directory 5 IoCs
Processes:
911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exepid process 1496 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe 1496 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 1448 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 1452 svchost.exe Token: SeLoadDriverPrivilege 1448 TXPlatforn.exe Token: 33 1448 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 1448 TXPlatforn.exe Token: 33 1448 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 1448 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exeHD_911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exepid process 1496 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe 1496 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe 2440 HD_911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exesvchost.exeTXPlatforn.execmd.exesvchost.exedescription pid process target process PID 1496 wrote to memory of 1452 1496 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe svchost.exe PID 1496 wrote to memory of 1452 1496 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe svchost.exe PID 1496 wrote to memory of 1452 1496 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe svchost.exe PID 1452 wrote to memory of 2400 1452 svchost.exe cmd.exe PID 1452 wrote to memory of 2400 1452 svchost.exe cmd.exe PID 1452 wrote to memory of 2400 1452 svchost.exe cmd.exe PID 1192 wrote to memory of 1448 1192 TXPlatforn.exe TXPlatforn.exe PID 1192 wrote to memory of 1448 1192 TXPlatforn.exe TXPlatforn.exe PID 1192 wrote to memory of 1448 1192 TXPlatforn.exe TXPlatforn.exe PID 1496 wrote to memory of 1632 1496 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe svchos.exe PID 1496 wrote to memory of 1632 1496 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe svchos.exe PID 1496 wrote to memory of 1632 1496 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe svchos.exe PID 1496 wrote to memory of 2440 1496 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe HD_911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe PID 1496 wrote to memory of 2440 1496 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe HD_911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe PID 1496 wrote to memory of 2440 1496 911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe HD_911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe PID 2400 wrote to memory of 4636 2400 cmd.exe PING.EXE PID 2400 wrote to memory of 4636 2400 cmd.exe PING.EXE PID 2400 wrote to memory of 4636 2400 cmd.exe PING.EXE PID 3620 wrote to memory of 1232 3620 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 3620 wrote to memory of 1232 3620 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 3620 wrote to memory of 1232 3620 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe"C:\Users\Admin\AppData\Local\Temp\911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exeC:\Users\Admin\AppData\Local\Temp\HD_911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240600343.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_911411bc0725199da39f1aa1046f08dd3c41261b6cad7d2a679bfb1533213d32.exeFilesize
4.4MB
MD50f128be67323844e5350d49186606b61
SHA1ed26c44792bdeb80d1b066291a0a10cfc9284656
SHA2563271e5026982f941dfc836d249073c084e6b093a85d7f5bade9ba55bfc10e96d
SHA512e097e9fe0a20586bf42ffb017a77d2e15c6256404c17692c61e3b3ac5e5e4705af335c8691ea94360a6f540cea8824ab9b0a22855773b8d19b31d501edf8f3a9
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.6MB
MD599bf33a15d3843230d83a139586454df
SHA1a02e6ab7dbde451375cb4f8dbb177bb46a0f73f5
SHA256b72c3caeba1659abd7c088b5be2227ec485ddd9a4292b3aac588d677e02bd4cd
SHA512526dd86c6bb4e21489f1c4a930c9883ba4d3a6e348c1aac1ca5ac5d869cae812b27191f8f1fc686e951efc98886ff7d881415985a7dfd7dbc4bde9e150d4d4d4
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
C:\Windows\SysWOW64\240600343.txtFilesize
50KB
MD5d970ef1963dc55e34962e7b0ac66b271
SHA1eadbb093b15b9b4d835295fc5e85221467c2f931
SHA256fb4ce853b8e8e2525f85fba8849e053bec4465851e9ffac3b3199d32a37e48d0
SHA512ead7c7464ff28360fa1c6fe202d1df33b86302e2106ab7a5bf498cd0bb3ec255b79ccc540ed923bd5c24144d579c9b6937ae62e4a8a864254e7b220444fd4da7
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
memory/1192-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1192-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1192-26-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1192-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1192-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1448-38-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1448-42-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1448-48-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1448-23-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1452-10-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1452-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1452-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1452-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB