Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-07-2024 05:26
Static task
static1
Behavioral task
behavioral1
Sample
61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe
Resource
win7-20240221-en
General
-
Target
61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe
-
Size
2.4MB
-
MD5
3dc5664b750b604b05b867b167a82e7e
-
SHA1
36d12cc8769c8549dd85a27bd452d30ea1dd89f7
-
SHA256
61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f
-
SHA512
ed2bb6d76dfbbb2697ebaff7f8c0f7bacf90d6770596e2e0331f92df205169f9a8a6c57731c4161b3e79d82d65fc0d273b4ae57a8dd0b6dc9ed9c415ea71def3
-
SSDEEP
49152:F09XJt4HIN2H2tFvduySbfq/qw/qCVwjXySfyVX5MX:mZJt4HINy2Lkbfq/qw/qC0bIk
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2224-12-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2224-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1064-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2224-21-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1064-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2256-35-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2256-60-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2256-72-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/2224-12-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2224-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1064-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2224-21-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1064-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2256-35-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2256-60-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2256-72-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
Processes:
RVN.exeTXPlatforn.exeTXPlatforn.exeHD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exepid process 2224 RVN.exe 1064 TXPlatforn.exe 2256 TXPlatforn.exe 2868 HD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe -
Loads dropped DLL 3 IoCs
Processes:
61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exeTXPlatforn.exepid process 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe 1064 TXPlatforn.exe 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe -
Processes:
resource yara_rule behavioral1/memory/2224-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2224-12-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2224-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1064-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2224-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1064-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2256-35-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2256-60-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2256-72-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
RVN.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 4 IoCs
Processes:
61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exedescription ioc process File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exepid process 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2256 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RVN.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2224 RVN.exe Token: SeLoadDriverPrivilege 2256 TXPlatforn.exe Token: 33 2256 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2256 TXPlatforn.exe Token: 33 2256 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2256 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exepid process 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exeRVN.exeTXPlatforn.execmd.exedescription pid process target process PID 1704 wrote to memory of 2224 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe RVN.exe PID 1704 wrote to memory of 2224 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe RVN.exe PID 1704 wrote to memory of 2224 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe RVN.exe PID 1704 wrote to memory of 2224 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe RVN.exe PID 1704 wrote to memory of 2224 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe RVN.exe PID 1704 wrote to memory of 2224 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe RVN.exe PID 1704 wrote to memory of 2224 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe RVN.exe PID 2224 wrote to memory of 2004 2224 RVN.exe cmd.exe PID 2224 wrote to memory of 2004 2224 RVN.exe cmd.exe PID 2224 wrote to memory of 2004 2224 RVN.exe cmd.exe PID 2224 wrote to memory of 2004 2224 RVN.exe cmd.exe PID 1064 wrote to memory of 2256 1064 TXPlatforn.exe TXPlatforn.exe PID 1064 wrote to memory of 2256 1064 TXPlatforn.exe TXPlatforn.exe PID 1064 wrote to memory of 2256 1064 TXPlatforn.exe TXPlatforn.exe PID 1064 wrote to memory of 2256 1064 TXPlatforn.exe TXPlatforn.exe PID 1064 wrote to memory of 2256 1064 TXPlatforn.exe TXPlatforn.exe PID 1064 wrote to memory of 2256 1064 TXPlatforn.exe TXPlatforn.exe PID 1064 wrote to memory of 2256 1064 TXPlatforn.exe TXPlatforn.exe PID 1704 wrote to memory of 2868 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe HD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe PID 1704 wrote to memory of 2868 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe HD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe PID 1704 wrote to memory of 2868 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe HD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe PID 1704 wrote to memory of 2868 1704 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe HD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe PID 2004 wrote to memory of 2556 2004 cmd.exe PING.EXE PID 2004 wrote to memory of 2556 2004 cmd.exe PING.EXE PID 2004 wrote to memory of 2556 2004 cmd.exe PING.EXE PID 2004 wrote to memory of 2556 2004 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe"C:\Users\Admin\AppData\Local\Temp\61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\HD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exeC:\Users\Admin\AppData\Local\Temp\HD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.3MB
MD58ad9fea7c1223d21bd9625d478524425
SHA1c7a5d88b182e8509053e936c49ec8fe216acbd98
SHA256c91279f0a48b76eb9eb71b1563152103d21dcb5dbe10098fe51599d51c6972ec
SHA5122feeff80a21465ac08b8db0867cb2042a106eabfd827314fb51cadf5a3569aa9f90b2dd805b3556e531b88c6f3ba3f9fa3b4cb06d59310b0802ea32c2cb852eb
-
\Users\Admin\AppData\Local\Temp\HD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exeFilesize
1.1MB
MD5b27638c5bf1a03e71d80d04490c41b4a
SHA1077089e424340d3242aa6267dea83463bde27684
SHA25630234bf4181102110f53cca082d710458aee6b5d50d61082fefe3a233cb5d1e0
SHA512509846024d6a6052815c4620de8298fc5f4c7d87c317fa0c89f6de4f98fbefcca83ccdaf689182b33e81e955bfc1a4ef9abcfd68f4f47ea7d87194f6b2763f11
-
\Users\Admin\AppData\Local\Temp\RVN.exeFilesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
memory/1064-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1064-29-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2224-5-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2224-12-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2224-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2224-21-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2256-35-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2256-60-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2256-72-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB