Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 04:14
Static task
static1
Behavioral task
behavioral1
Sample
847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exe
Resource
win7-20231129-en
General
-
Target
847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exe
-
Size
1.5MB
-
MD5
3945c6da50c19c4bb8e7221f167c0b67
-
SHA1
5556c0bdbb7ade9d3a919f4e70bbec23cf67b1bb
-
SHA256
847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1
-
SHA512
21df65470adceff3bc9a7be8f9b75751b6667f637fd8bc20d1d9e7facf8af2f2c98a599ed3e5514aea52de2ba36511f39c37046ed5bf1ddc1ab64341301bcc62
-
SSDEEP
24576:V09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+jyzdCw2lHzgV:V09XJt4HIN2H2tFvduySyeRzgV
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/316-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/316-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/316-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3132-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3132-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3132-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2308-24-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2308-30-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3132-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2308-40-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2308-73-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/316-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/316-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/316-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3132-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3132-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3132-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2308-24-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2308-30-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3132-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2308-40-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2308-73-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 3 IoCs
Processes:
RVN.exeTXPlatforn.exeTXPlatforn.exepid process 316 RVN.exe 3132 TXPlatforn.exe 2308 TXPlatforn.exe -
Processes:
resource yara_rule behavioral2/memory/316-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/316-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/316-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/316-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3132-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3132-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3132-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3132-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2308-24-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2308-30-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3132-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2308-40-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2308-73-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
RVN.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 5 IoCs
Processes:
847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exedescription ioc process File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2308 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RVN.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 316 RVN.exe Token: SeLoadDriverPrivilege 2308 TXPlatforn.exe Token: 33 2308 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2308 TXPlatforn.exe Token: 33 2308 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2308 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exepid process 2164 847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exe 2164 847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exeRVN.exeTXPlatforn.execmd.exedescription pid process target process PID 2164 wrote to memory of 316 2164 847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exe RVN.exe PID 2164 wrote to memory of 316 2164 847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exe RVN.exe PID 2164 wrote to memory of 316 2164 847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exe RVN.exe PID 316 wrote to memory of 620 316 RVN.exe cmd.exe PID 316 wrote to memory of 620 316 RVN.exe cmd.exe PID 316 wrote to memory of 620 316 RVN.exe cmd.exe PID 3132 wrote to memory of 2308 3132 TXPlatforn.exe TXPlatforn.exe PID 3132 wrote to memory of 2308 3132 TXPlatforn.exe TXPlatforn.exe PID 3132 wrote to memory of 2308 3132 TXPlatforn.exe TXPlatforn.exe PID 620 wrote to memory of 5040 620 cmd.exe PING.EXE PID 620 wrote to memory of 5040 620 cmd.exe PING.EXE PID 620 wrote to memory of 5040 620 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exe"C:\Users\Admin\AppData\Local\Temp\847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.5MB
MD53945c6da50c19c4bb8e7221f167c0b67
SHA15556c0bdbb7ade9d3a919f4e70bbec23cf67b1bb
SHA256847a758a3e104aaf03b0e58d0bac47dba37d70ab9693de2562f9806f6382d7b1
SHA51221df65470adceff3bc9a7be8f9b75751b6667f637fd8bc20d1d9e7facf8af2f2c98a599ed3e5514aea52de2ba36511f39c37046ed5bf1ddc1ab64341301bcc62
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeFilesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
memory/316-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/316-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/316-10-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/316-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2308-24-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2308-30-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2308-40-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2308-73-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3132-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3132-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3132-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3132-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3132-36-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB