Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 05:26
Static task
static1
Behavioral task
behavioral1
Sample
61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe
Resource
win7-20240221-en
General
-
Target
61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe
-
Size
2.4MB
-
MD5
3dc5664b750b604b05b867b167a82e7e
-
SHA1
36d12cc8769c8549dd85a27bd452d30ea1dd89f7
-
SHA256
61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f
-
SHA512
ed2bb6d76dfbbb2697ebaff7f8c0f7bacf90d6770596e2e0331f92df205169f9a8a6c57731c4161b3e79d82d65fc0d273b4ae57a8dd0b6dc9ed9c415ea71def3
-
SSDEEP
49152:F09XJt4HIN2H2tFvduySbfq/qw/qCVwjXySfyVX5MX:mZJt4HINy2Lkbfq/qw/qC0bIk
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2092-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2132-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2344-34-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2344-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2344-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2344-37-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2132-27-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2092-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2132-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2132-17-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2092-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/2092-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2092-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2132-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2344-34-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2344-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2344-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2344-37-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2132-27-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2092-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2132-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2132-17-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2092-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
Processes:
RVN.exeTXPlatforn.exeTXPlatforn.exeHD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exepid process 2092 RVN.exe 2132 TXPlatforn.exe 2344 TXPlatforn.exe 1480 HD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe -
Processes:
resource yara_rule behavioral2/memory/2092-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2092-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2132-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2344-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2344-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2344-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2344-37-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2132-27-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2092-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2132-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2132-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2132-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2092-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2092-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
RVN.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 5 IoCs
Processes:
61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exepid process 1636 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe 1636 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2344 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RVN.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2092 RVN.exe Token: SeLoadDriverPrivilege 2344 TXPlatforn.exe Token: 33 2344 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2344 TXPlatforn.exe Token: 33 2344 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2344 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exepid process 1636 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe 1636 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exeRVN.exeTXPlatforn.execmd.exedescription pid process target process PID 1636 wrote to memory of 2092 1636 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe RVN.exe PID 1636 wrote to memory of 2092 1636 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe RVN.exe PID 1636 wrote to memory of 2092 1636 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe RVN.exe PID 2092 wrote to memory of 2016 2092 RVN.exe cmd.exe PID 2092 wrote to memory of 2016 2092 RVN.exe cmd.exe PID 2092 wrote to memory of 2016 2092 RVN.exe cmd.exe PID 2132 wrote to memory of 2344 2132 TXPlatforn.exe TXPlatforn.exe PID 2132 wrote to memory of 2344 2132 TXPlatforn.exe TXPlatforn.exe PID 2132 wrote to memory of 2344 2132 TXPlatforn.exe TXPlatforn.exe PID 1636 wrote to memory of 1480 1636 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe HD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe PID 1636 wrote to memory of 1480 1636 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe HD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe PID 1636 wrote to memory of 1480 1636 61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe HD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe PID 2016 wrote to memory of 440 2016 cmd.exe PING.EXE PID 2016 wrote to memory of 440 2016 cmd.exe PING.EXE PID 2016 wrote to memory of 440 2016 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe"C:\Users\Admin\AppData\Local\Temp\61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\HD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exeC:\Users\Admin\AppData\Local\Temp\HD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_61cc0d2c237fbdb4e3d92187430e1d13b0c2d0ac3cd0f308b6037b1aa2d3895f.exeFilesize
1.1MB
MD5b27638c5bf1a03e71d80d04490c41b4a
SHA1077089e424340d3242aa6267dea83463bde27684
SHA25630234bf4181102110f53cca082d710458aee6b5d50d61082fefe3a233cb5d1e0
SHA512509846024d6a6052815c4620de8298fc5f4c7d87c317fa0c89f6de4f98fbefcca83ccdaf689182b33e81e955bfc1a4ef9abcfd68f4f47ea7d87194f6b2763f11
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.3MB
MD58ad9fea7c1223d21bd9625d478524425
SHA1c7a5d88b182e8509053e936c49ec8fe216acbd98
SHA256c91279f0a48b76eb9eb71b1563152103d21dcb5dbe10098fe51599d51c6972ec
SHA5122feeff80a21465ac08b8db0867cb2042a106eabfd827314fb51cadf5a3569aa9f90b2dd805b3556e531b88c6f3ba3f9fa3b4cb06d59310b0802ea32c2cb852eb
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeFilesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
memory/2092-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2092-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2092-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2092-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2092-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2132-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2132-27-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2132-17-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2132-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2132-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2344-37-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2344-31-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2344-32-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2344-34-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB