Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-07-2024 05:13
Static task
static1
Behavioral task
behavioral1
Sample
3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe
Resource
win7-20240221-en
General
-
Target
3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe
-
Size
5.9MB
-
MD5
8baec3f11289a10ca1586d3565eb195b
-
SHA1
ec99ca2dc06a6237dd46ff53a36e04075379d18c
-
SHA256
3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7
-
SHA512
bd67afd1b1a8e83ee7023ae6f0de19c445d83fb8fff8a0ea99339f08ee85784e476527106979924ccdfeb2900206d8139d2a8c1eb9baaff27038c1548ab08ed8
-
SSDEEP
98304:GZJt4HINy2LkU9ExrG51s0pA5cCKUO8Rc9CMzuewKmjTyh5ppGIVwR9+daaYgoaq:siINy2LkU9rG2oTQ5pprVwR9+ZYPAyQY
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2228-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2228-8-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2228-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2380-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2380-22-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2152-29-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2152-30-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2152-37-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2152-39-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2228-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2228-8-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2228-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2380-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2380-22-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2152-29-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2152-30-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2152-37-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2152-39-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 4 IoCs
Processes:
RVN.exeTXPlatforn.exeTXPlatforn.exeHD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exepid process 2228 RVN.exe 2380 TXPlatforn.exe 2152 TXPlatforn.exe 2716 HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe -
Loads dropped DLL 3 IoCs
Processes:
3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exeTXPlatforn.exepid process 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe 2380 TXPlatforn.exe 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe -
Processes:
resource yara_rule behavioral1/memory/2228-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2228-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2228-8-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2228-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2380-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2380-22-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2152-29-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2152-30-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2152-37-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2152-39-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
RVN.exedescription ioc process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
Drops file in Program Files directory 4 IoCs
Processes:
3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exedescription ioc process File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exeHD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exepid process 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe 2716 HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe 2716 HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe 2716 HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe 2716 HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2152 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
RVN.exeTXPlatforn.exeHD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exedescription pid process Token: SeIncBasePriorityPrivilege 2228 RVN.exe Token: SeLoadDriverPrivilege 2152 TXPlatforn.exe Token: SeDebugPrivilege 2716 HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe Token: SeDebugPrivilege 2716 HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe Token: 33 2152 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2152 TXPlatforn.exe Token: 33 2152 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2152 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exeHD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exepid process 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe 2716 HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe 2716 HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exeRVN.exeTXPlatforn.execmd.exedescription pid process target process PID 2344 wrote to memory of 2228 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe RVN.exe PID 2344 wrote to memory of 2228 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe RVN.exe PID 2344 wrote to memory of 2228 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe RVN.exe PID 2344 wrote to memory of 2228 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe RVN.exe PID 2344 wrote to memory of 2228 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe RVN.exe PID 2344 wrote to memory of 2228 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe RVN.exe PID 2344 wrote to memory of 2228 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe RVN.exe PID 2228 wrote to memory of 1668 2228 RVN.exe cmd.exe PID 2228 wrote to memory of 1668 2228 RVN.exe cmd.exe PID 2228 wrote to memory of 1668 2228 RVN.exe cmd.exe PID 2228 wrote to memory of 1668 2228 RVN.exe cmd.exe PID 2380 wrote to memory of 2152 2380 TXPlatforn.exe TXPlatforn.exe PID 2380 wrote to memory of 2152 2380 TXPlatforn.exe TXPlatforn.exe PID 2380 wrote to memory of 2152 2380 TXPlatforn.exe TXPlatforn.exe PID 2380 wrote to memory of 2152 2380 TXPlatforn.exe TXPlatforn.exe PID 2380 wrote to memory of 2152 2380 TXPlatforn.exe TXPlatforn.exe PID 2380 wrote to memory of 2152 2380 TXPlatforn.exe TXPlatforn.exe PID 2380 wrote to memory of 2152 2380 TXPlatforn.exe TXPlatforn.exe PID 2344 wrote to memory of 2716 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe PID 2344 wrote to memory of 2716 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe PID 2344 wrote to memory of 2716 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe PID 2344 wrote to memory of 2716 2344 3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe PID 1668 wrote to memory of 2440 1668 cmd.exe PING.EXE PID 1668 wrote to memory of 2440 1668 cmd.exe PING.EXE PID 1668 wrote to memory of 2440 1668 cmd.exe PING.EXE PID 1668 wrote to memory of 2440 1668 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe"C:\Users\Admin\AppData\Local\Temp\3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exeC:\Users\Admin\AppData\Local\Temp\HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_3b8dc14de3d39e7093e713a8b63757405b086cec60e14897777756a0c4749ad7.exeFilesize
4.5MB
MD581a0d4fa8d22aad638379aa8b1d0c69e
SHA1734730784c748694e091dc2c1c688d229c7c931d
SHA256c34da741e82529ec5942079ecff532ad10e03d8882de262a6f0ac31842c4d20d
SHA5120a4bfb6693dbef4a6679a58d1958d9c0ac2fdc992a90c6d5f438a9ab0834428d3840a31a9ce685b0aa6eb00d5ad74071304fa7790d337f3b01a50c2a8aa3e198
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.3MB
MD5b7be7aae156d1245c00656cfe9bf7b05
SHA1c665995e6ce1ba8b14cfbe1c9ee6c793e8b575b2
SHA25644c1ea05f76711fd780daf7d49dec617ae338451e4f0bbcf6f173ae9616f533c
SHA512b232afc7e5658204e1737bff6d45a972c913fbd01a049a9090df17351bc9c4ad5f6b178fbc5eafeab9ff3866ce5b978d293324016a23f9f5d480faa165cd7960
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.4MB
MD57361e0d1c99b65236286727dba8122de
SHA139db91661340ee257da91df84d204280e74ec188
SHA25636763362e7bccc1c3615d717a13fb33750c913713a317c6adb928d53f170aad3
SHA512b08b59e4ec9694feb62ab86952c68c7213b9aca56535b7a01b19c7e651e60847b628532505a27bd081599686ba79d6c2967c84872e706d54d6aa968bf6597c33
-
\Users\Admin\AppData\Local\Temp\RVN.exeFilesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
-
memory/2152-30-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2152-39-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2152-37-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2152-29-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2228-8-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2228-7-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2228-9-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2228-5-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2380-22-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2380-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB