gh0strat | d2917799bb47bda19b1310a56290995dfed005bd318656d647a9c3e46a8fd117

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2917799bb47bda19b1310a56290995dfed005bd318656d647a9c3e46a8fd117.dll
Size 1.6MB
Sample230828-dc91gaeh89
SHA256 d2917799bb47bda19b1310a56290995dfed005bd318656d647a9c3e46a8fd117
MD5 bbffe4ad49a192556a933decee1c0614
SHA1 b1fed18a09018aae23459b6ad673c861fbadbbfd
SHA512 da02389a16fb70334aac3b5d3b923cf0128d5f1db793589c49681562b233e3e35e49bd299dc583e1e3264587bccf515eb894c6cbe5d4b6fa6ed76cae09406190
SSDEEP 49152:ZHf+cWJKq358AJoaqMyY58V4M+gF7Nvas7tc1/xh:5fpWJKq3eAJVqMgSM+gDas7O/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 4 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/3368-9-0x0000000010000000-0x00000000101A0000-memory.dmp	purplefox_rootkit
behavioral2/memory/3384-24-0x0000000010000000-0x00000000101A0000-memory.dmp	purplefox_rootkit
behavioral2/memory/548-39-0x0000000010000000-0x00000000101A0000-memory.dmp	purplefox_rootkit
behavioral2/files/0x000600000002322f-50.dat	purplefox_rootkit

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/3368-9-0x0000000010000000-0x00000000101A0000-memory.dmp	family_gh0strat
behavioral2/memory/3384-24-0x0000000010000000-0x00000000101A0000-memory.dmp	family_gh0strat
behavioral2/memory/548-39-0x0000000010000000-0x00000000101A0000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	23.exe
File opened for modification	C:\Windows\system32\drivers\QAssist.sys	Aqrjk.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	23.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	Aqrjk.exe

Executes dropped EXE 3 IoCs

pid	Process
3368	23.exe
3384	23.exe
548	Aqrjk.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	23.exe
File opened (read-only)	\??\N:	23.exe
File opened (read-only)	\??\R:	23.exe
File opened (read-only)	\??\H:	Aqrjk.exe
File opened (read-only)	\??\K:	Aqrjk.exe
File opened (read-only)	\??\L:	23.exe
File opened (read-only)	\??\S:	23.exe
File opened (read-only)	\??\Y:	23.exe
File opened (read-only)	\??\N:	Aqrjk.exe
File opened (read-only)	\??\I:	23.exe
File opened (read-only)	\??\Q:	23.exe
File opened (read-only)	\??\G:	Aqrjk.exe
File opened (read-only)	\??\V:	Aqrjk.exe
File opened (read-only)	\??\Y:	Aqrjk.exe
File opened (read-only)	\??\E:	23.exe
File opened (read-only)	\??\U:	23.exe
File opened (read-only)	\??\V:	23.exe
File opened (read-only)	\??\U:	Aqrjk.exe
File opened (read-only)	\??\X:	Aqrjk.exe
File opened (read-only)	\??\W:	Aqrjk.exe
File opened (read-only)	\??\B:	23.exe
File opened (read-only)	\??\H:	23.exe
File opened (read-only)	\??\W:	23.exe
File opened (read-only)	\??\Z:	23.exe
File opened (read-only)	\??\B:	Aqrjk.exe
File opened (read-only)	\??\J:	Aqrjk.exe
File opened (read-only)	\??\O:	Aqrjk.exe
File opened (read-only)	\??\Z:	Aqrjk.exe
File opened (read-only)	\??\M:	23.exe
File opened (read-only)	\??\E:	Aqrjk.exe
File opened (read-only)	\??\P:	Aqrjk.exe
File opened (read-only)	\??\R:	Aqrjk.exe
File opened (read-only)	\??\P:	23.exe
File opened (read-only)	\??\X:	23.exe
File opened (read-only)	\??\I:	Aqrjk.exe
File opened (read-only)	\??\S:	Aqrjk.exe
File opened (read-only)	\??\G:	23.exe
File opened (read-only)	\??\J:	23.exe
File opened (read-only)	\??\O:	23.exe
File opened (read-only)	\??\T:	23.exe
File opened (read-only)	\??\L:	Aqrjk.exe
File opened (read-only)	\??\M:	Aqrjk.exe
File opened (read-only)	\??\Q:	Aqrjk.exe
File opened (read-only)	\??\T:	Aqrjk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5000	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe
3384	23.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
3384	23.exe
548	Aqrjk.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3368	23.exe
Token: SeLoadDriverPrivilege	3384	23.exe
Token: SeLoadDriverPrivilege	548	Aqrjk.exe
Token: 33	3384	23.exe
Token: SeIncBasePriorityPrivilege	3384	23.exe
Token: 33	548	Aqrjk.exe
Token: SeIncBasePriorityPrivilege	548	Aqrjk.exe
Token: 33	3384	23.exe
Token: SeIncBasePriorityPrivilege	3384	23.exe
Token: 33	548	Aqrjk.exe
Token: SeIncBasePriorityPrivilege	548	Aqrjk.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3244	rundll32.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 3244	5056	rundll32.exe	82
PID 5056 wrote to memory of 3244	5056	rundll32.exe	82
PID 5056 wrote to memory of 3244	5056	rundll32.exe	82
PID 3244 wrote to memory of 3368	3244	rundll32.exe	83
PID 3244 wrote to memory of 3368	3244	rundll32.exe	83
PID 3244 wrote to memory of 3368	3244	rundll32.exe	83
PID 3244 wrote to memory of 3384	3244	rundll32.exe	85
PID 3244 wrote to memory of 3384	3244	rundll32.exe	85
PID 3244 wrote to memory of 3384	3244	rundll32.exe	85
PID 3368 wrote to memory of 548	3368	23.exe	86
PID 3368 wrote to memory of 548	3368	23.exe	86
PID 3368 wrote to memory of 548	3368	23.exe	86
PID 3368 wrote to memory of 2968	3368	23.exe	87
PID 3368 wrote to memory of 2968	3368	23.exe	87
PID 3368 wrote to memory of 2968	3368	23.exe	87
PID 2968 wrote to memory of 5000	2968	cmd.exe	91
PID 2968 wrote to memory of 5000	2968	cmd.exe	91
PID 2968 wrote to memory of 5000	2968	cmd.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2917799bb47bda19b1310a56290995dfed005bd318656d647a9c3e46a8fd117.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2917799bb47bda19b1310a56290995dfed005bd318656d647a9c3e46a8fd117.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Users\Admin\Documents\23.exe
    C:\Users\Admin\Documents\23.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Aqrjk.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Aqrjk.exe"
      4⤵
      Drops file in Drivers directory
      Sets service image path in registry
      Executes dropped EXE
      Enumerates connected drives
      Suspicious behavior: LoadsDriver
      Suspicious use of AdjustPrivilegeToken
      PID:548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\DOCUME~1\23.exe > nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 127.0.0.1
        5⤵
        Runs ping.exe
        
        PID:5000
- - C:\Users\Admin\Documents\23.exe
    C:\Users\Admin\Documents\23.exe
    3⤵
    - Drops file in Drivers directory
    - Sets service image path in registry
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aqrjk.exe

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Aqrjk.exe
Size 1.2MB
SHA256 004ad835e51b10bc72d92c84f91e8f3e736ff6dbac56e3117d91679420731df9
MD5 deefb8461cce6ef2c0095a2707040a83
SHA1 f82ffedcdb19e4b4f1b90cb8594ce6e536b76a63
SHA512 69d51bdb232aaba3f2b52249a5937b2f2ab7e065638938f14cf49ac9dd800f6c9acd91af055d378d69f4d21439fc339a8b902df5d80df0480f3b20ba58c6e1ff
SSDEEP 12288:3LzuzOJmRHyaGA1sVr8QgrMdFKDu5D0J+687oVZTZ+34EIW7koCEyIjG9:3ezAqHGdeQI+sK0p876T+3BIW7GEyMI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aqrjk.exe

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Aqrjk.exe
Size 1.2MB
SHA256 004ad835e51b10bc72d92c84f91e8f3e736ff6dbac56e3117d91679420731df9
MD5 deefb8461cce6ef2c0095a2707040a83
SHA1 f82ffedcdb19e4b4f1b90cb8594ce6e536b76a63
SHA512 69d51bdb232aaba3f2b52249a5937b2f2ab7e065638938f14cf49ac9dd800f6c9acd91af055d378d69f4d21439fc339a8b902df5d80df0480f3b20ba58c6e1ff
SSDEEP 12288:3LzuzOJmRHyaGA1sVr8QgrMdFKDu5D0J+687oVZTZ+34EIW7koCEyIjG9:3ezAqHGdeQI+sK0p876T+3BIW7GEyMI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aqrjk.exe

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Aqrjk.exe
Size 1.2MB
SHA256 004ad835e51b10bc72d92c84f91e8f3e736ff6dbac56e3117d91679420731df9
MD5 deefb8461cce6ef2c0095a2707040a83
SHA1 f82ffedcdb19e4b4f1b90cb8594ce6e536b76a63
SHA512 69d51bdb232aaba3f2b52249a5937b2f2ab7e065638938f14cf49ac9dd800f6c9acd91af055d378d69f4d21439fc339a8b902df5d80df0480f3b20ba58c6e1ff
SSDEEP 12288:3LzuzOJmRHyaGA1sVr8QgrMdFKDu5D0J+687oVZTZ+34EIW7koCEyIjG9:3ezAqHGdeQI+sK0p876T+3BIW7GEyMI
MD5 SHA1 SHA512 SSDEEP

Submit Download

23.exe

Path C:\Users\Admin\Documents\23.exe
Size 1.2MB
SHA256 004ad835e51b10bc72d92c84f91e8f3e736ff6dbac56e3117d91679420731df9
MD5 deefb8461cce6ef2c0095a2707040a83
SHA1 f82ffedcdb19e4b4f1b90cb8594ce6e536b76a63
SHA512 69d51bdb232aaba3f2b52249a5937b2f2ab7e065638938f14cf49ac9dd800f6c9acd91af055d378d69f4d21439fc339a8b902df5d80df0480f3b20ba58c6e1ff
SSDEEP 12288:3LzuzOJmRHyaGA1sVr8QgrMdFKDu5D0J+687oVZTZ+34EIW7koCEyIjG9:3ezAqHGdeQI+sK0p876T+3BIW7GEyMI
MD5 SHA1 SHA512 SSDEEP

Submit Download

23.exe

Path C:\Users\Admin\Documents\23.exe
Size 1.2MB
SHA256 004ad835e51b10bc72d92c84f91e8f3e736ff6dbac56e3117d91679420731df9
MD5 deefb8461cce6ef2c0095a2707040a83
SHA1 f82ffedcdb19e4b4f1b90cb8594ce6e536b76a63
SHA512 69d51bdb232aaba3f2b52249a5937b2f2ab7e065638938f14cf49ac9dd800f6c9acd91af055d378d69f4d21439fc339a8b902df5d80df0480f3b20ba58c6e1ff
SSDEEP 12288:3LzuzOJmRHyaGA1sVr8QgrMdFKDu5D0J+687oVZTZ+34EIW7koCEyIjG9:3ezAqHGdeQI+sK0p876T+3BIW7GEyMI
MD5 SHA1 SHA512 SSDEEP

Submit Download

23.exe

Path C:\Users\Admin\Documents\23.exe
Size 1.2MB
SHA256 004ad835e51b10bc72d92c84f91e8f3e736ff6dbac56e3117d91679420731df9
MD5 deefb8461cce6ef2c0095a2707040a83
SHA1 f82ffedcdb19e4b4f1b90cb8594ce6e536b76a63
SHA512 69d51bdb232aaba3f2b52249a5937b2f2ab7e065638938f14cf49ac9dd800f6c9acd91af055d378d69f4d21439fc339a8b902df5d80df0480f3b20ba58c6e1ff
SSDEEP 12288:3LzuzOJmRHyaGA1sVr8QgrMdFKDu5D0J+687oVZTZ+34EIW7koCEyIjG9:3ezAqHGdeQI+sK0p876T+3BIW7GEyMI
MD5 SHA1 SHA512 SSDEEP

Submit Download

QAssist.sys

Path C:\Windows\system32\drivers\QAssist.sys
Size 76KB
SHA256 6cce28b275d5ec20992bb13790976caf434ab46ddbfd5cfd431d33424943122b
MD5 4e34c068e764ad0ff0cb58bc4f143197
SHA1 1a392a469fc8c65d80055c1a7aaee27bf5ebe7c4
SHA512 dcea6d76452b1ac9e3c1fed7463fe873b4dd4603ec67a4e204c27ba2c1ea79415508c3044223626f0ae499a9b7a3d6fb283f0978b5e20a58e959c9440376e98b
SSDEEP 1536:svHIPCv5eT9OrLPC5VwHrhpTrkt5Ad53vE1qXn9Jm6Y:svHIPmn/rHrhpTrkt52E1qXpY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/548-39-0x0000000010000000-0x00000000101A0000-memory.dmp

Download

memory/3244-0-0x0000000010000000-0x0000000010422000-memory.dmp

Download

memory/3244-1-0x0000000010000000-0x0000000010422000-memory.dmp

Download

memory/3368-9-0x0000000010000000-0x00000000101A0000-memory.dmp

Download

memory/3384-24-0x0000000010000000-0x00000000101A0000-memory.dmp

Download