gh0strat | a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf

General

Target

a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf.exe
Size

36KB
MD5

37641f75d748d88ab97b797024bed92e
SHA1

381f79a5f11f1caaa4faf419394ab4b72d836a35
SHA256

a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf
SHA512

d0dd3aaa39b67fdadb5af3eadd4f0e88e34a05194af06db16b5b009a6766a318fd351238e1284a0fbbebbbb51f596dcf2a3917e27809d2c7acf8acfb832646eb
SSDEEP

768:sLno9rS3XcdDhF40Un2WZKaM4C0I8qyM6k46l94A/1CgInmB7o01:sLngS3XcdDhF4Hn2WcaM4C0I8qyM6k42

Score

10^/10

gh0strat purplefox rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral2/memory/1868-169-0x0000000010000000-0x0000000010191000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1868-169-0x0000000010000000-0x0000000010191000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf.exe

Executes dropped EXE 2 IoCs

Processes:

2.exetest.exe

pid process

1868 2.exe
2060 test.exe

pid	process
1868	2.exe
2060	test.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2.exe

description	ioc	process
File opened (read-only)	\??\I:	2.exe
File opened (read-only)	\??\K:	2.exe
File opened (read-only)	\??\M:	2.exe
File opened (read-only)	\??\R:	2.exe
File opened (read-only)	\??\S:	2.exe
File opened (read-only)	\??\Y:	2.exe
File opened (read-only)	\??\F:	2.exe
File opened (read-only)	\??\E:	2.exe
File opened (read-only)	\??\G:	2.exe
File opened (read-only)	\??\J:	2.exe
File opened (read-only)	\??\L:	2.exe
File opened (read-only)	\??\N:	2.exe
File opened (read-only)	\??\P:	2.exe
File opened (read-only)	\??\U:	2.exe
File opened (read-only)	\??\B:	2.exe
File opened (read-only)	\??\X:	2.exe
File opened (read-only)	\??\T:	2.exe
File opened (read-only)	\??\V:	2.exe
File opened (read-only)	\??\O:	2.exe
File opened (read-only)	\??\Q:	2.exe
File opened (read-only)	\??\W:	2.exe
File opened (read-only)	\??\Z:	2.exe
File opened (read-only)	\??\H:	2.exe

Drops file in System32 directory 3 IoCs

Processes:

mmc.exe

description	ioc	process
File opened for modification	C:\Windows\System32\gpedit.msc	mmc.exe
File opened for modification	C:\Windows\System32\GroupPolicy	mmc.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	mmc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2.exe

Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

test.exe

pid	process
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe
2060	test.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

mmc.exe

pid process

2700 mmc.exe

pid	process
2700	mmc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

mmc.exe

description	pid	process
Token: 33	2700	mmc.exe
Token: SeIncBasePriorityPrivilege	2700	mmc.exe
Token: 33	2700	mmc.exe
Token: SeIncBasePriorityPrivilege	2700	mmc.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf.exe2.exemmc.exe

pid process

1908 a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf.exe
1868 2.exe
1868 2.exe
2700 mmc.exe
2700 mmc.exe
2700 mmc.exe
2700 mmc.exe

pid	process
1908	a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf.exe
1868	2.exe
1868	2.exe
2700	mmc.exe
2700	mmc.exe
2700	mmc.exe
2700	mmc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf.exetest.exe

description	pid	process	target process
PID 1908 wrote to memory of 1868	1908	a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf.exe	2.exe
PID 1908 wrote to memory of 1868	1908	a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf.exe	2.exe
PID 1908 wrote to memory of 1868	1908	a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf.exe	2.exe
PID 1908 wrote to memory of 2060	1908	a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf.exe	test.exe
PID 1908 wrote to memory of 2060	1908	a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf.exe	test.exe
PID 1908 wrote to memory of 2060	1908	a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf.exe	test.exe
PID 2060 wrote to memory of 3632	2060	test.exe	cmd.exe
PID 2060 wrote to memory of 3632	2060	test.exe	cmd.exe
PID 2060 wrote to memory of 3632	2060	test.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf.exe
"C:\Users\Admin\AppData\Local\Temp\a7bba18c14cabef751e162e9cc0d98aa0bf37c6c0f5672433da12ca71ba579bf.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908

C:\ProgramData\homo\2.exe
"C:\ProgramData\homo\2.exe"
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1868

C:\ProgramData\homo\test.exe
"C:\ProgramData\homo\test.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\SysWOW64\cmd.exe
cmd /c start C:\ProgramData\114514
3⤵
- Modifies registry class
PID:3632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:116

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\System32\gpedit.msc"
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2700

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\homo\2.exe
Filesize
1.2MB

MD5
04cec9f2f932c78b519974ab006e57a6

SHA1
50cf7ee6f89c83717b72de9812cddcdc46ceafba

SHA256
0d087098875950c4783aeb9cb557ad517fc52649560dbbd7b6d83974ae560b07

SHA512
6088abaa8632bfba76efbadf1043e2262933aa95181b1fa630a43aac619861e0d32424ad89423a8b6899567d44332b43788b81db8f015d572fda9e425db9dcd7

Download Submit
C:\ProgramData\homo\2.exe
Filesize
1.2MB

MD5
04cec9f2f932c78b519974ab006e57a6

SHA1
50cf7ee6f89c83717b72de9812cddcdc46ceafba

SHA256
0d087098875950c4783aeb9cb557ad517fc52649560dbbd7b6d83974ae560b07

SHA512
6088abaa8632bfba76efbadf1043e2262933aa95181b1fa630a43aac619861e0d32424ad89423a8b6899567d44332b43788b81db8f015d572fda9e425db9dcd7

Download Submit
C:\ProgramData\homo\2.exe
Filesize
1.2MB

MD5
04cec9f2f932c78b519974ab006e57a6

SHA1
50cf7ee6f89c83717b72de9812cddcdc46ceafba

SHA256
0d087098875950c4783aeb9cb557ad517fc52649560dbbd7b6d83974ae560b07

SHA512
6088abaa8632bfba76efbadf1043e2262933aa95181b1fa630a43aac619861e0d32424ad89423a8b6899567d44332b43788b81db8f015d572fda9e425db9dcd7

Download Submit
C:\ProgramData\homo\test.exe
Filesize
714KB

MD5
6a21305b111e4a7824c2fa967e65f275

SHA1
f021e6229e3abbb7eb1fbc1bac1567da14905743

SHA256
1ce6cee595032e9771ec63c986bb96d2d7065dc50f77d27022e6815f9058dedb

SHA512
90f9edcfdfde467d3eea8f0aa112f872a7e92fa6bceabba7eba2f66a82a292c2bdb13026ec1e13cadb963a4661be09184a4bac78410506b30ff83e1e102e18f0

Download Submit
C:\ProgramData\homo\test.exe
Filesize
714KB

MD5
6a21305b111e4a7824c2fa967e65f275

SHA1
f021e6229e3abbb7eb1fbc1bac1567da14905743

SHA256
1ce6cee595032e9771ec63c986bb96d2d7065dc50f77d27022e6815f9058dedb

SHA512
90f9edcfdfde467d3eea8f0aa112f872a7e92fa6bceabba7eba2f66a82a292c2bdb13026ec1e13cadb963a4661be09184a4bac78410506b30ff83e1e102e18f0

Download Submit
C:\ProgramData\homo\test.exe
Filesize
714KB

MD5
6a21305b111e4a7824c2fa967e65f275

SHA1
f021e6229e3abbb7eb1fbc1bac1567da14905743

SHA256
1ce6cee595032e9771ec63c986bb96d2d7065dc50f77d27022e6815f9058dedb

SHA512
90f9edcfdfde467d3eea8f0aa112f872a7e92fa6bceabba7eba2f66a82a292c2bdb13026ec1e13cadb963a4661be09184a4bac78410506b30ff83e1e102e18f0

Download Submit
memory/1868-169-0x0000000010000000-0x0000000010191000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads