Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 05:08
Static task
static1
Behavioral task
behavioral1
Sample
ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe
Resource
win7-20240220-en
General
-
Target
ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe
-
Size
4.0MB
-
MD5
ff32ba92bc13642565628d231522c8e7
-
SHA1
3fe53758e3eee25d2e473a2561fabed8839f1b12
-
SHA256
ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb
-
SHA512
49167df30cfe2be460de147b23c5f687592e31f53bbe544137de486f553b4004a15b47123f07b6349985a8575f31a89ca43a1293a14f3333ffe594d6b9a35101
-
SSDEEP
98304:2GdVyVT9nOgmhHDmn2nU5WP4ukA8TbLGNMZw:lWT9nO79mnCUYgukhHw
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2164-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2952-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2952-30-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2592-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2592-43-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2592-33-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2592-32-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2952-16-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2952-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2164-10-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2164-6-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/2164-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2952-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2952-30-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2592-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat C:\Windows\SysWOW64\240631218.txt family_gh0strat behavioral2/memory/2592-43-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2592-33-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2592-32-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2952-16-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2952-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2164-10-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2164-6-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240631218.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
Processes:
svchost.exeTXPlatforn.exesvchos.exeTXPlatforn.exeHD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2164 svchost.exe 2952 TXPlatforn.exe 4600 svchos.exe 2592 TXPlatforn.exe 840 HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 3620 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 3 IoCs
Processes:
svchos.exesvchost.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 4600 svchos.exe 3868 svchost.exe 3620 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral2/memory/2164-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2952-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2952-30-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2592-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2592-43-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2592-33-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2592-32-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2952-16-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2952-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2952-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2164-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2164-6-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2164-4-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
Processes:
svchost.exesvchos.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\240631218.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe -
Drops file in Program Files directory 5 IoCs
Processes:
ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exeHD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exepid process 2236 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 2236 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 840 HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 840 HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 840 HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 840 HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 840 HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 840 HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 840 HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 840 HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2592 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exeTXPlatforn.exedescription pid process Token: SeIncBasePriorityPrivilege 2164 svchost.exe Token: SeLoadDriverPrivilege 2592 TXPlatforn.exe Token: 33 2592 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2592 TXPlatforn.exe Token: 33 2592 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2592 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exepid process 2236 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe 2236 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exesvchost.exeTXPlatforn.execmd.exesvchost.exedescription pid process target process PID 2236 wrote to memory of 2164 2236 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchost.exe PID 2236 wrote to memory of 2164 2236 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchost.exe PID 2236 wrote to memory of 2164 2236 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchost.exe PID 2164 wrote to memory of 1496 2164 svchost.exe cmd.exe PID 2164 wrote to memory of 1496 2164 svchost.exe cmd.exe PID 2164 wrote to memory of 1496 2164 svchost.exe cmd.exe PID 2236 wrote to memory of 4600 2236 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchos.exe PID 2236 wrote to memory of 4600 2236 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchos.exe PID 2236 wrote to memory of 4600 2236 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe svchos.exe PID 2952 wrote to memory of 2592 2952 TXPlatforn.exe TXPlatforn.exe PID 2952 wrote to memory of 2592 2952 TXPlatforn.exe TXPlatforn.exe PID 2952 wrote to memory of 2592 2952 TXPlatforn.exe TXPlatforn.exe PID 2236 wrote to memory of 840 2236 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe PID 2236 wrote to memory of 840 2236 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe PID 2236 wrote to memory of 840 2236 ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe PID 1496 wrote to memory of 1112 1496 cmd.exe PING.EXE PID 1496 wrote to memory of 1112 1496 cmd.exe PING.EXE PID 1496 wrote to memory of 1112 1496 cmd.exe PING.EXE PID 3868 wrote to memory of 3620 3868 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 3868 wrote to memory of 3620 3868 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 3868 wrote to memory of 3620 3868 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe"C:\Users\Admin\AppData\Local\Temp\ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exeC:\Users\Admin\AppData\Local\Temp\HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240631218.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.4MB
MD556f6e0d061bd3093c2170e3707f1b274
SHA121282cebba84a1a2f601a81e0191d43cd5399a6d
SHA2562b8cf67787bf6ba3af18aaf089eb860d49762ff0c89232c324222544aaf36559
SHA512f203e3fa09aeb2ffd99e0dbe7f89a76e8aad21621ee26b617395a99bdc9c0532e1a04629431b3b8a1f865d7fb0c58a5e28fcb913f4534230f702c362a066f656
-
C:\Users\Admin\AppData\Local\Temp\HD_ac539ffb5e574bc44d9244188499a26c34f2c98604f76646651365b483a18bbb.exeFilesize
2.5MB
MD551b6cde3ad56d6020bbe61a1cf47fb72
SHA16f46d5f57cd260cf3f783d51340c95b183537d68
SHA25669f1feeb578701b8008d0362062923248a08b2e024b54f59afd871fa204e6e66
SHA512d257ebcdb96e2331ceae78f41d343b5aa1eb11088cd31bfe2dc751f9994e5665b944c3b5b743943b1057f426439b4a1ae49b68693d63a192685f12a7fa5d7261
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
C:\Users\Admin\AppData\Roaming\2345SoftMgr\update\2345SoftMgr.CheckVersion.dataFilesize
29B
MD599fb8e84b8aa92889349054a60e1f359
SHA11b3dd1afb4fe4533ca16db4dd3e7845c13b0e1c5
SHA2565313e624a817ebcb34675027d12b87465de4fc4fdddfdd74d244490c4911b8e4
SHA5122a99095109445c3ca1b9fad5c87fdfed331641401ca8d19d3ab4d109e18b9dc5feb739485f14f390bd3bcfa3a4325e3b1278fe1bb8690dd8df16edb9af52faac
-
C:\Windows\SysWOW64\240631218.txtFilesize
50KB
MD570ade033a355b919f35e014f464737b3
SHA181cbf3acac7d5e9533a644fc8d57534f03452132
SHA2560259c27d962c7ba803fb1f33180348db9134c5611082aee433474e352c25a462
SHA51217607225ff7f5ea97fc0b9906f50937f022656762dd21a85b939b40d167c98a904a10a81a5ba40b8db88e2891aa5ca65d7e33ac55034bfc6ee1942550a97c5d6
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
memory/2164-10-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2164-6-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2164-4-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2164-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2592-43-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2592-33-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2592-32-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2592-36-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2952-16-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2952-19-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2952-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2952-30-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2952-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB