gh0strat | 5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49

General

Target

5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
Size

3.6MB
MD5

35ea1c048a22ad043a34822f3dca4b7c
SHA1

91a2e3e49fdb7cd39602b4fa77c3f41e7804e333
SHA256

5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49
SHA512

dd240d13e6960448642f5fd76c516852c7d1a5473203fa7e5dedafeb5a21158a996c91ce9c0abfc461d740188aac7eabeb713d9f747e699e43c52ba7f8aead3b
SSDEEP

98304:4LNg+h8U3yR7/zAlMlZs7R0yPpI1KEuTw5wEOp:4LNPaLRDzblZsN0yxTU+vp

Score

10^/10

gh0strat purplefox rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral2/memory/5008-136-0x0000000010000000-0x0000000010041000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5008-136-0x0000000010000000-0x0000000010041000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

Processes:

5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe

pid	process
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe

Drops file in Program Files directory 2 IoCs

Processes:

5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe

description	ioc	process
File created	C:\Program Files\MSXML 6.18\Romensenslkk.exe	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
File opened for modification	C:\Program Files\MSXML 6.18\Romensenslkk.exe	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe

pid	process
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe

description pid process

Token: SeDebugPrivilege 5008 5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe

description	pid	process
Token: SeDebugPrivilege	5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe

pid	process
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
5008	5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe

C:\Users\Admin\AppData\Local\Temp\5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe
"C:\Users\Admin\AppData\Local\Temp\5a1da40e6fa1b53c3f0b4f14c5e14d14dcdbd8f15dca652a090e5c5fc0b54f49.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5008-133-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download
memory/5008-134-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/5008-136-0x0000000010000000-0x0000000010041000-memory.dmp

Filesize
260KB

Download
memory/5008-143-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download
memory/5008-144-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download
memory/5008-145-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/5008-146-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download
memory/5008-147-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download
memory/5008-148-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download
memory/5008-149-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download
memory/5008-150-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download
memory/5008-151-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download
memory/5008-152-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download
memory/5008-153-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download
memory/5008-154-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download
memory/5008-155-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download
memory/5008-156-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download
memory/5008-157-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download
memory/5008-158-0x0000000000400000-0x00000000013E6000-memory.dmp

Filesize
15.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads