Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05-07-2024 05:08
Static task
static1
Behavioral task
behavioral1
Sample
ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe
Resource
win7-20240220-en
General
-
Target
ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe
-
Size
4.0MB
-
MD5
ff32ba92bc13642565628d231522c8e7
-
SHA1
3fe53758e3eee25d2e473a2561fabed8839f1b12
-
SHA256
ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb
-
SHA512
49167df30cfe2be460de147b23c5f687592e31f53bbe544137de486f553b4004a15b47123f07b6349985a8575f31a89ca43a1293a14f3333ffe594d6b9a35101
-
SSDEEP
98304:2GdVyVT9nOgmhHDmn2nU5WP4ukA8TbLGNMZw:lWT9nO79mnCUYgukhHw
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2948-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2948-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2948-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2884-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2884-27-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2576-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2576-35-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2576-40-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2948-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2948-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2948-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2884-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2884-27-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2576-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2576-35-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat \Windows\SysWOW64\259398571.txt family_gh0strat behavioral1/memory/2576-40-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259398571.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
Processes:
svchost.exeTXPlatforn.exeTXPlatforn.exesvchos.exeHD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2948 svchost.exe 2884 TXPlatforn.exe 2576 TXPlatforn.exe 2716 svchos.exe 2484 HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 2248 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 8 IoCs
Processes:
ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exeTXPlatforn.exesvchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 2884 TXPlatforn.exe 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 2716 svchos.exe 2568 svchost.exe 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 2568 svchost.exe 2248 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral1/memory/2948-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2948-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2948-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2948-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2884-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2884-27-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2576-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2576-35-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2576-40-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchos.exesvchost.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\259398571.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exeHD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exepid process 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 2484 HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 2484 HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 2484 HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 2484 HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 2484 HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2576 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2948 svchost.exe Token: SeLoadDriverPrivilege 2576 TXPlatforn.exe Token: 33 2576 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2576 TXPlatforn.exe Token: 33 2576 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2576 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exepid process 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exesvchost.exeTXPlatforn.execmd.exesvchost.exedescription pid process target process PID 2268 wrote to memory of 2948 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchost.exe PID 2268 wrote to memory of 2948 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchost.exe PID 2268 wrote to memory of 2948 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchost.exe PID 2268 wrote to memory of 2948 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchost.exe PID 2268 wrote to memory of 2948 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchost.exe PID 2268 wrote to memory of 2948 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchost.exe PID 2268 wrote to memory of 2948 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchost.exe PID 2948 wrote to memory of 2932 2948 svchost.exe cmd.exe PID 2948 wrote to memory of 2932 2948 svchost.exe cmd.exe PID 2948 wrote to memory of 2932 2948 svchost.exe cmd.exe PID 2948 wrote to memory of 2932 2948 svchost.exe cmd.exe PID 2884 wrote to memory of 2576 2884 TXPlatforn.exe TXPlatforn.exe PID 2884 wrote to memory of 2576 2884 TXPlatforn.exe TXPlatforn.exe PID 2884 wrote to memory of 2576 2884 TXPlatforn.exe TXPlatforn.exe PID 2884 wrote to memory of 2576 2884 TXPlatforn.exe TXPlatforn.exe PID 2884 wrote to memory of 2576 2884 TXPlatforn.exe TXPlatforn.exe PID 2884 wrote to memory of 2576 2884 TXPlatforn.exe TXPlatforn.exe PID 2884 wrote to memory of 2576 2884 TXPlatforn.exe TXPlatforn.exe PID 2268 wrote to memory of 2716 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchos.exe PID 2268 wrote to memory of 2716 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchos.exe PID 2268 wrote to memory of 2716 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchos.exe PID 2268 wrote to memory of 2716 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchos.exe PID 2932 wrote to memory of 2772 2932 cmd.exe PING.EXE PID 2932 wrote to memory of 2772 2932 cmd.exe PING.EXE PID 2932 wrote to memory of 2772 2932 cmd.exe PING.EXE PID 2932 wrote to memory of 2772 2932 cmd.exe PING.EXE PID 2268 wrote to memory of 2484 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe PID 2268 wrote to memory of 2484 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe PID 2268 wrote to memory of 2484 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe PID 2268 wrote to memory of 2484 2268 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe PID 2568 wrote to memory of 2248 2568 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2568 wrote to memory of 2248 2568 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2568 wrote to memory of 2248 2568 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2568 wrote to memory of 2248 2568 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe"C:\Users\Admin\AppData\Local\Temp\ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exeC:\Users\Admin\AppData\Local\Temp\HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259398571.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.4MB
MD556f6e0d061bd3093c2170e3707f1b274
SHA121282cebba84a1a2f601a81e0191d43cd5399a6d
SHA2562b8cf67787bf6ba3af18aaf089eb860d49762ff0c89232c324222544aaf36559
SHA512f203e3fa09aeb2ffd99e0dbe7f89a76e8aad21621ee26b617395a99bdc9c0532e1a04629431b3b8a1f865d7fb0c58a5e28fcb913f4534230f702c362a066f656
-
C:\Users\Admin\AppData\Roaming\2345SoftMgr\update\2345SoftMgr.CheckVersion.dataFilesize
29B
MD599fb8e84b8aa92889349054a60e1f359
SHA11b3dd1afb4fe4533ca16db4dd3e7845c13b0e1c5
SHA2565313e624a817ebcb34675027d12b87465de4fc4fdddfdd74d244490c4911b8e4
SHA5122a99095109445c3ca1b9fad5c87fdfed331641401ca8d19d3ab4d109e18b9dc5feb739485f14f390bd3bcfa3a4325e3b1278fe1bb8690dd8df16edb9af52faac
-
\Users\Admin\AppData\Local\Temp\HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exeFilesize
2.5MB
MD551b6cde3ad56d6020bbe61a1cf47fb72
SHA16f46d5f57cd260cf3f783d51340c95b183537d68
SHA25669f1feeb578701b8008d0362062923248a08b2e024b54f59afd871fa204e6e66
SHA512d257ebcdb96e2331ceae78f41d343b5aa1eb11088cd31bfe2dc751f9994e5665b944c3b5b743943b1057f426439b4a1ae49b68693d63a192685f12a7fa5d7261
-
\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
\Windows\SysWOW64\259398571.txtFilesize
50KB
MD570ade033a355b919f35e014f464737b3
SHA181cbf3acac7d5e9533a644fc8d57534f03452132
SHA2560259c27d962c7ba803fb1f33180348db9134c5611082aee433474e352c25a462
SHA51217607225ff7f5ea97fc0b9906f50937f022656762dd21a85b939b40d167c98a904a10a81a5ba40b8db88e2891aa5ca65d7e33ac55034bfc6ee1942550a97c5d6
-
\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
memory/2576-32-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2576-35-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2576-40-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2884-27-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2884-19-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2948-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2948-9-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2948-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2948-5-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB