Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-07-2024 04:18
Static task
static1
Behavioral task
behavioral1
Sample
7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe
Resource
win7-20240221-en
General
-
Target
7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe
-
Size
14.5MB
-
MD5
219fdbf81f8b2ec0b83e77be9ca4cfb3
-
SHA1
8615f9a57d4a569c25e666038f51ba76d3b2e013
-
SHA256
7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546
-
SHA512
4a1e8452645ff815b46792e93af88d048882e1f9ed6754fd9708a892264b89e4d3d42e7ddf35ad7bba328fb54d7d3542a79f3c17cd28a331bad3ec22785734f2
-
SSDEEP
196608:uiINy2Lkb3G7ElPut9H9o2nnWb+wQ3IKlTHlUIZlY+m:RqEkt9H+qrDlUIZlY+m
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1652-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1652-12-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1652-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2580-26-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2580-30-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2964-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2580-38-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2964-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2580-72-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1652-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1652-12-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1652-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2580-26-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2580-30-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2964-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2580-38-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2964-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2580-72-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
Processes:
RVN.exeTXPlatforn.exeTXPlatforn.exeHD_7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exepid process 1652 RVN.exe 2964 TXPlatforn.exe 2580 TXPlatforn.exe 1940 HD_7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe -
Loads dropped DLL 3 IoCs
Processes:
7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exeTXPlatforn.exepid process 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe 2964 TXPlatforn.exe 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe -
Processes:
resource yara_rule behavioral1/memory/1652-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1652-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1652-12-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1652-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2580-26-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2580-30-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2964-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2580-38-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2964-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2580-72-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
RVN.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 4 IoCs
Processes:
7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exepid process 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2580 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RVN.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 1652 RVN.exe Token: SeLoadDriverPrivilege 2580 TXPlatforn.exe Token: 33 2580 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2580 TXPlatforn.exe Token: 33 2580 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2580 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exepid process 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exeRVN.exeTXPlatforn.execmd.exedescription pid process target process PID 2476 wrote to memory of 1652 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe RVN.exe PID 2476 wrote to memory of 1652 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe RVN.exe PID 2476 wrote to memory of 1652 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe RVN.exe PID 2476 wrote to memory of 1652 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe RVN.exe PID 2476 wrote to memory of 1652 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe RVN.exe PID 2476 wrote to memory of 1652 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe RVN.exe PID 2476 wrote to memory of 1652 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe RVN.exe PID 1652 wrote to memory of 2608 1652 RVN.exe cmd.exe PID 1652 wrote to memory of 2608 1652 RVN.exe cmd.exe PID 1652 wrote to memory of 2608 1652 RVN.exe cmd.exe PID 1652 wrote to memory of 2608 1652 RVN.exe cmd.exe PID 2964 wrote to memory of 2580 2964 TXPlatforn.exe TXPlatforn.exe PID 2964 wrote to memory of 2580 2964 TXPlatforn.exe TXPlatforn.exe PID 2964 wrote to memory of 2580 2964 TXPlatforn.exe TXPlatforn.exe PID 2964 wrote to memory of 2580 2964 TXPlatforn.exe TXPlatforn.exe PID 2964 wrote to memory of 2580 2964 TXPlatforn.exe TXPlatforn.exe PID 2964 wrote to memory of 2580 2964 TXPlatforn.exe TXPlatforn.exe PID 2964 wrote to memory of 2580 2964 TXPlatforn.exe TXPlatforn.exe PID 2476 wrote to memory of 1940 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe HD_7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe PID 2476 wrote to memory of 1940 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe HD_7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe PID 2476 wrote to memory of 1940 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe HD_7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe PID 2476 wrote to memory of 1940 2476 7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe HD_7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe PID 2608 wrote to memory of 2944 2608 cmd.exe PING.EXE PID 2608 wrote to memory of 2944 2608 cmd.exe PING.EXE PID 2608 wrote to memory of 2944 2608 cmd.exe PING.EXE PID 2608 wrote to memory of 2944 2608 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe"C:\Users\Admin\AppData\Local\Temp\7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\HD_7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exeC:\Users\Admin\AppData\Local\Temp\HD_7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_7880dc8e0e8636e765eec32fb83bcf16757e3925cf529f2358d6db50c113e546.exeFilesize
13.1MB
MD553a403f3c959ffd881842ce4b34a8bfb
SHA117a651095c1275cadfd22610d87f7fe634fad3dc
SHA2566f5fc73056c0370e97fc8da1b85742376985b8015862f7d339da72f2b2316828
SHA51271bad7e89d59633e50535c596245f0f25f0395b2c60e717cda070714d133e9fcb855ab7a1ae02bdb3369e42914566ac127c0d8a74d756f5a23aaa4dd223d8cd7
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.4MB
MD529e866ef32ce6892501649bc8978c35a
SHA14d10a6ff6cc1585775607df95fa337d967b5739f
SHA2564f8444988f7b832dc71da7ba73745d9ae7eef93fba75544c02aa93c7e6ed0551
SHA51293f9f84ed2bfbab5421537ce09ad27a902029d8dcbbe65168944b04c731245d07779efefe73bf63d4d86d8de242db702eb9ac9a434f571a0630f53c2bc321d23
-
\Users\Admin\AppData\Local\Temp\RVN.exeFilesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
memory/1652-5-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1652-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1652-12-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1652-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2580-30-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2580-38-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2580-26-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2580-72-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2964-29-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2964-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB