gh0strat | 7ee5450afa7aae8af9ed319028de5a080dc554ee52b9eabf14117c61850b89b6

Resubmissions

20-06-2023 15:51

230620-tarzwaeb41 10

20-06-2023 15:47

230620-s8kssaeb31 10

Analysis

max time kernel
50s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20230221-ja
resource tags

arch:x64arch:x86image:win10v2004-20230221-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
20-06-2023 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

maochilaoshu.exe
Size

2.9MB
MD5

0772c75ff821f29e479ddc1da9a87740
SHA1

a06b6ed12126982f590893526ae6e3eec56ee4fc
SHA256

97c0b79f8421a1b0c3ef8129564ecf8b6ef037bdd432c8e856fd84e5d207edf4
SHA512

f0c40bb177c6ec4879840410fd0510bdf3c5d3e6a0de8d8f4ca98c23d0557f41f3e557184637ee9b29821b24927d5cea2951b118c84f5164a65ed3a580631286
SSDEEP

49152:WVbFeZNzXNBukNbW1Z6ZbaHcYz5aAVKiw6ZWqTG93jJ3hWpVcQ:ubONzdBPKg3Yz5J/693kb

Score

10^/10

gh0strat purplefox rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral1/memory/1356-175-0x0000000010000000-0x0000000010192000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1356-175-0x0000000010000000-0x0000000010192000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

maochilaoshu.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	maochilaoshu.exe

Executes dropped EXE 3 IoCs

Processes:

v.exev.exejerryrat.exe

pid process

4696 v.exe
4844 v.exe
1356 jerryrat.exe

pid	process
4696	v.exe
4844	v.exe
1356	jerryrat.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

jerryrat.exe

description	ioc	process
File opened (read-only)	\??\M:	jerryrat.exe
File opened (read-only)	\??\P:	jerryrat.exe
File opened (read-only)	\??\Q:	jerryrat.exe
File opened (read-only)	\??\R:	jerryrat.exe
File opened (read-only)	\??\T:	jerryrat.exe
File opened (read-only)	\??\U:	jerryrat.exe
File opened (read-only)	\??\E:	jerryrat.exe
File opened (read-only)	\??\I:	jerryrat.exe
File opened (read-only)	\??\V:	jerryrat.exe
File opened (read-only)	\??\K:	jerryrat.exe
File opened (read-only)	\??\N:	jerryrat.exe
File opened (read-only)	\??\S:	jerryrat.exe
File opened (read-only)	\??\Y:	jerryrat.exe
File opened (read-only)	\??\B:	jerryrat.exe
File opened (read-only)	\??\G:	jerryrat.exe
File opened (read-only)	\??\X:	jerryrat.exe
File opened (read-only)	\??\J:	jerryrat.exe
File opened (read-only)	\??\L:	jerryrat.exe
File opened (read-only)	\??\O:	jerryrat.exe
File opened (read-only)	\??\W:	jerryrat.exe
File opened (read-only)	\??\Z:	jerryrat.exe
File opened (read-only)	\??\F:	jerryrat.exe
File opened (read-only)	\??\H:	jerryrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4232 452 WerFault.exe

pid	pid_target	process	target process
4232	452	WerFault.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

jerryrat.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	jerryrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	jerryrat.exe

Modifies registry class 1 IoCs

Processes:

maochilaoshu.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings maochilaoshu.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	maochilaoshu.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

maochilaoshu.exejerryrat.exe

pid	process
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
3688	maochilaoshu.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe
1356	jerryrat.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

maochilaoshu.exehh.exehh.exe

pid process

3688 maochilaoshu.exe
3688 maochilaoshu.exe
2668 hh.exe
2668 hh.exe
4364 hh.exe
4364 hh.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

maochilaoshu.execmd.exe

description	pid	process	target process
PID 3688 wrote to memory of 3792	3688	maochilaoshu.exe	cmd.exe
PID 3688 wrote to memory of 3792	3688	maochilaoshu.exe	cmd.exe
PID 3688 wrote to memory of 3792	3688	maochilaoshu.exe	cmd.exe
PID 3792 wrote to memory of 3900	3792	cmd.exe	reg.exe
PID 3792 wrote to memory of 3900	3792	cmd.exe	reg.exe
PID 3792 wrote to memory of 3900	3792	cmd.exe	reg.exe
PID 3688 wrote to memory of 4696	3688	maochilaoshu.exe	v.exe
PID 3688 wrote to memory of 4696	3688	maochilaoshu.exe	v.exe
PID 3688 wrote to memory of 4696	3688	maochilaoshu.exe	v.exe
PID 3688 wrote to memory of 4844	3688	maochilaoshu.exe	v.exe
PID 3688 wrote to memory of 4844	3688	maochilaoshu.exe	v.exe
PID 3688 wrote to memory of 4844	3688	maochilaoshu.exe	v.exe
PID 3688 wrote to memory of 1356	3688	maochilaoshu.exe	jerryrat.exe
PID 3688 wrote to memory of 1356	3688	maochilaoshu.exe	jerryrat.exe
PID 3688 wrote to memory of 1356	3688	maochilaoshu.exe	jerryrat.exe

C:\Users\Admin\AppData\Local\Temp\maochilaoshu.exe
"C:\Users\Admin\AppData\Local\Temp\maochilaoshu.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Public\xiaodaxzqxia\n.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:3792

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" /v "1201" /d "0" /t REG_DWORD /f
3⤵
PID:3900

C:\Users\Public\xiaodaxzqxia\v.exe
"C:\Users\Public\xiaodaxzqxia\v.exe" -o -d C:\Users\Public\xiaodaxzqxia C:\Users\Public\xiaodaxzqxia\111
2⤵
- Executes dropped EXE
PID:4696

C:\Users\Public\xiaodaxzqxia\v.exe
"C:\Users\Public\xiaodaxzqxia\v.exe" -o -d C:\Users\Public\xiaodaxzqxia C:\Users\Public\xiaodaxzqxia\ma
2⤵
- Executes dropped EXE
PID:4844

C:\Users\Public\xiaodaxzqxia\jerryrat.exe
C:\Users\Public\xiaodaxzqxia\jerryrat.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1356

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4532

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Public\cxzvasdfg\9111884419198725\A11.chm
1⤵
- Suspicious use of SetWindowsHookEx
PID:2668

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Public\cxzvasdfg\9111884419198725\A11.chm
1⤵
- Suspicious use of SetWindowsHookEx
PID:4364

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 436 -p 452 -ip 452
1⤵
PID:180

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 452 -s 1108
1⤵
- Program crash
PID:4232

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\HTML Help\hh.dat
Filesize
8KB

MD5
adc8b0e1cd2921f762477f24ac5c4d35

SHA1
f2523ed6882cf80816e20dc80b87b664143e4e81

SHA256
ebeda0a4edfdf1edc04dfd7f9488dc85c63d1596d9021569b7c453b971d5da25

SHA512
541e277b78360aeb7e18cab92a4e73092484eec662415ef639fc9d0df056f12cea3aaf5e7584d90dae06cc79d7c6536dad6d745ae6e8513cc0a0f4eccc54d43b

Download Submit
C:\Users\Public\cxzvasdfg\9111884419198725\A11.chm
Filesize
11KB

MD5
db7961bf21e69e9cdbbfbc5357b6ae84

SHA1
6b43da6f1a502cc3ede9a46a71536e79335e3169

SHA256
49c7fc9d58e588bdcac23d7d576b699d49d5497de8afcb73be23cab89edf3b0e

SHA512
e0c7f502e60c9a15d407416645266614dd1e29c42c4711f1f3e10bd0de4c2404994fc71d3cb73a5ca56977afdf36f96c4e60b2bccce7459a1988877f197312f8

Download Submit
C:\Users\Public\xiaodaxzqxia\111
Filesize
1.5MB

MD5
6a37b4b3fa7c30242de550f429aedef1

SHA1
f7996877a0cdae7c6328c19c35f430f90803cae1

SHA256
a52e30d8dc89acd2e22fb56e95c919ed87fe908b829e77f380e284d9a2312776

SHA512
c715f6c0588f5534c79c5580840f412ca8693e546551b5786bedc8c8a1d76af36d8fb5b8fe19435b9ec182da19ff27b81693a739674ee83de52d103d6a8fd1f8

Download Submit
C:\Users\Public\xiaodaxzqxia\jerryrat.exe
Filesize
101.8MB

MD5
bf1b730495a79f66eab2aac35a0b2817

SHA1
d89578047501d4e220de0a47872f1515117153a2

SHA256
c823dd3f6793fb25914a64329dff85d770929df1dd1561bff47c59033aecdbd8

SHA512
e49bb70fd9608cbabb9e433b441224aaf46df31526b82c9463711b21e3ffa34c03c459eab25ca89f70949118fed9c5cb4113498a6263cdefaeef6f61e81c7bd4

Download Submit
C:\Users\Public\xiaodaxzqxia\jerryrat.exe
Filesize
101.8MB

MD5
bf1b730495a79f66eab2aac35a0b2817

SHA1
d89578047501d4e220de0a47872f1515117153a2

SHA256
c823dd3f6793fb25914a64329dff85d770929df1dd1561bff47c59033aecdbd8

SHA512
e49bb70fd9608cbabb9e433b441224aaf46df31526b82c9463711b21e3ffa34c03c459eab25ca89f70949118fed9c5cb4113498a6263cdefaeef6f61e81c7bd4

Download Submit
C:\Users\Public\xiaodaxzqxia\ma
Filesize
799KB

MD5
d66f3d98bb9260a2f25cb79fc43253d7

SHA1
74862b6db445959a9ef16a51b73c3dcedbe9be81

SHA256
64d9b2c4e4772ba2ee30f878aa0d006983b4de15764c8e7ddae74dc39611857c

SHA512
a830419304436966604f97022c9f938041196596f50864bee31ddda1d401e93e3f0494263652c8e3de277c81e6bb84eb20222efaea75c1af1ece374fe555b46c

Download Submit
C:\Users\Public\xiaodaxzqxia\n.bat
Filesize
263B

MD5
c7d8b33e05722104d63de564a5d92b01

SHA1
fd703f1c71ac1dae65dc34f3521854604cec8091

SHA256
538ce88a3eed5a98c6a021a4c541080c5cfb652962f37da620e35b537513317a

SHA512
54a80fc6ad3f08743dc1655c379de79f9496086a9a18f4716fc9a9d6a6fe4fd527dd4ac099c57408090b73903c64fa38d4723783708068878aa6e18c6cc0d08e

Download Submit
C:\Users\Public\xiaodaxzqxia\v.exe
Filesize
161KB

MD5
fecf803f7d84d4cfa81277298574d6e6

SHA1
0fd9a61bf9a361f87661de295e70a9c6795fe6a1

SHA256
81046f943d26501561612a629d8be95af254bc161011ba8a62d25c34c16d6d2a

SHA512
a4e2e2dfc98a874f7ec8318c40500b0e481fa4476d75d559f2895ce29fbe793a889fb2390220a25ab919deac477ada0c904b30f002324529285bda94292b48a4

Download Submit
C:\Users\Public\xiaodaxzqxia\v.exe
Filesize
161KB

MD5
fecf803f7d84d4cfa81277298574d6e6

SHA1
0fd9a61bf9a361f87661de295e70a9c6795fe6a1

SHA256
81046f943d26501561612a629d8be95af254bc161011ba8a62d25c34c16d6d2a

SHA512
a4e2e2dfc98a874f7ec8318c40500b0e481fa4476d75d559f2895ce29fbe793a889fb2390220a25ab919deac477ada0c904b30f002324529285bda94292b48a4

Download Submit
C:\Users\Public\xiaodaxzqxia\v.exe
Filesize
161KB

MD5
fecf803f7d84d4cfa81277298574d6e6

SHA1
0fd9a61bf9a361f87661de295e70a9c6795fe6a1

SHA256
81046f943d26501561612a629d8be95af254bc161011ba8a62d25c34c16d6d2a

SHA512
a4e2e2dfc98a874f7ec8318c40500b0e481fa4476d75d559f2895ce29fbe793a889fb2390220a25ab919deac477ada0c904b30f002324529285bda94292b48a4

Download Submit
memory/1356-175-0x0000000010000000-0x0000000010192000-memory.dmp

Filesize
1.6MB

Download
memory/4696-152-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4844-171-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

pid	process
3688	maochilaoshu.exe
3688	maochilaoshu.exe
2668	hh.exe
2668	hh.exe
4364	hh.exe
4364	hh.exe