gh0strat | ade7d77bea75470f2b172b27ffcb8d3ae43eefd1de981cb4d9a01b7f2cee46df

General

Target

ade7d77bea75470f2b172b27ffcb8d3ae43eefd1de981cb4d9a01b7f2cee46df.exe
Size

1.3MB
MD5

d7384ee609eb1a92b94523787c17614d
SHA1

6eb7a157ee0ebae281f50a5b6f6cc7598f0d7f56
SHA256

ade7d77bea75470f2b172b27ffcb8d3ae43eefd1de981cb4d9a01b7f2cee46df
SHA512

dfbaabeb0f3692d8e83f3eca45aab97c51c1b53290a10bdfea638702872fab8340d60c961346e8676d172590ba2216ae6d4f26f5ac2f1bd9f6fa72d029312cd0
SSDEEP

24576:9OyHutimZ9VSly2hVvHW6qMnSbTBBhBMNvFyzhyz:wHPkVOBTK

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 3 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/4296-0-0x0000000010000000-0x000000001019F000-memory.dmp	purplefox_rootkit
behavioral2/memory/4068-10-0x0000000010000000-0x000000001019F000-memory.dmp	purplefox_rootkit
behavioral2/memory/3900-17-0x0000000010000000-0x000000001019F000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/4296-0-0x0000000010000000-0x000000001019F000-memory.dmp	family_gh0strat
behavioral2/memory/4068-10-0x0000000010000000-0x000000001019F000-memory.dmp	family_gh0strat
behavioral2/memory/3900-17-0x0000000010000000-0x000000001019F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	Vnfvn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	Vnfvn.exe

Executes dropped EXE 2 IoCs

pid	Process
4068	Vnfvn.exe
3900	Vnfvn.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Vnfvn.exe	ade7d77bea75470f2b172b27ffcb8d3ae43eefd1de981cb4d9a01b7f2cee46df.exe
File opened for modification	C:\Windows\SysWOW64\Vnfvn.exe	ade7d77bea75470f2b172b27ffcb8d3ae43eefd1de981cb4d9a01b7f2cee46df.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2412	PING.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3900	Vnfvn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4296	ade7d77bea75470f2b172b27ffcb8d3ae43eefd1de981cb4d9a01b7f2cee46df.exe
Token: SeLoadDriverPrivilege	3900	Vnfvn.exe
Token: 33	3900	Vnfvn.exe
Token: SeIncBasePriorityPrivilege	3900	Vnfvn.exe
Token: 33	3900	Vnfvn.exe
Token: SeIncBasePriorityPrivilege	3900	Vnfvn.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 2384	4296	ade7d77bea75470f2b172b27ffcb8d3ae43eefd1de981cb4d9a01b7f2cee46df.exe	92
PID 4296 wrote to memory of 2384	4296	ade7d77bea75470f2b172b27ffcb8d3ae43eefd1de981cb4d9a01b7f2cee46df.exe	92
PID 4296 wrote to memory of 2384	4296	ade7d77bea75470f2b172b27ffcb8d3ae43eefd1de981cb4d9a01b7f2cee46df.exe	92
PID 4068 wrote to memory of 3900	4068	Vnfvn.exe	91
PID 4068 wrote to memory of 3900	4068	Vnfvn.exe	91
PID 4068 wrote to memory of 3900	4068	Vnfvn.exe	91
PID 2384 wrote to memory of 2412	2384	cmd.exe	93
PID 2384 wrote to memory of 2412	2384	cmd.exe	93
PID 2384 wrote to memory of 2412	2384	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\ade7d77bea75470f2b172b27ffcb8d3ae43eefd1de981cb4d9a01b7f2cee46df.exe
"C:\Users\Admin\AppData\Local\Temp\ade7d77bea75470f2b172b27ffcb8d3ae43eefd1de981cb4d9a01b7f2cee46df.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\ADE7D7~1.EXE > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2412

C:\Windows\SysWOW64\Vnfvn.exe
C:\Windows\SysWOW64\Vnfvn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\Vnfvn.exe
  C:\Windows\SysWOW64\Vnfvn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Vnfvn.exe

Filesize
1.3MB

MD5
d7384ee609eb1a92b94523787c17614d

SHA1
6eb7a157ee0ebae281f50a5b6f6cc7598f0d7f56

SHA256
ade7d77bea75470f2b172b27ffcb8d3ae43eefd1de981cb4d9a01b7f2cee46df

SHA512
dfbaabeb0f3692d8e83f3eca45aab97c51c1b53290a10bdfea638702872fab8340d60c961346e8676d172590ba2216ae6d4f26f5ac2f1bd9f6fa72d029312cd0

Download Submit
C:\Windows\SysWOW64\Vnfvn.exe

Filesize
180KB

MD5
2c9e4b08ff9e8186f68670b9bda1fcae

SHA1
85a659e52fdda4dc97e56565c6832b78a43b4de0

SHA256
9c638d1cfa8cf6a0fef6882b66fc82fee3392b688975afa7fcf3b5e67973d9d8

SHA512
893af94fde12d0cc95abaf35306e75fb36a039003c53b069a4fdcca959a0c23e87b383e22ebdced073cd8c78bc6acce511ad0a264b7aa8f209aea154af1caf1e

Download Submit
C:\Windows\SysWOW64\Vnfvn.exe

Filesize
247KB

MD5
0bb8e5731226ccdd34c98f3a036e0283

SHA1
7fc9d1d334937bf3a39fed1c42142e4d06e51bbf

SHA256
b10fa4be90fda8949285c20890869276abbda9f198f10c13caa5e466cfba5003

SHA512
2519403b601c6bef689ed20f85597f0bb7cfa38b422368986ed0091667fed6608dfabbb73673e3447587ac6848941ab2a493506af3f69fd1ea2c2a1f27b9e5a1

Download Submit
memory/3900-17-0x0000000010000000-0x000000001019F000-memory.dmp

Filesize
1.6MB

Download
memory/4068-10-0x0000000010000000-0x000000001019F000-memory.dmp

Filesize
1.6MB

Download
memory/4296-0-0x0000000010000000-0x000000001019F000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads