gh0strat | 6e9d7dbba6fcc3b5b270c36bfb02f8299541713a5db856ce578d241fe9b24475

General

Target
6e9d7dbba6fcc3b5b270c36bfb02f8299541713a5db856ce578d241fe9b24475.exe
Size 1.3MB
Sample240426-maeafseb7s
SHA256 6e9d7dbba6fcc3b5b270c36bfb02f8299541713a5db856ce578d241fe9b24475
MD5 be464d79903e8fbd97c034734a3138d2
SHA1 d81651c5e57070a73ba9cc03791bd98de8ba4db6
SHA512 b3bd150bfc8cf017d358416114e9e126ff95bb14cb5dc9e32108f783e8e8b9833fb4b78c05defb9e7a795098e9053c78d595c0d874aba344c2388cb59639961b
SSDEEP 24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNH:QHPkVOBTK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 3 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/4960-0-0x0000000010000000-0x000000001019F000-memory.dmp	purplefox_rootkit
behavioral2/memory/2008-11-0x0000000010000000-0x000000001019F000-memory.dmp	purplefox_rootkit
behavioral2/memory/3372-18-0x0000000010000000-0x000000001019F000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/4960-0-0x0000000010000000-0x000000001019F000-memory.dmp	family_gh0strat
behavioral2/memory/2008-11-0x0000000010000000-0x000000001019F000-memory.dmp	family_gh0strat
behavioral2/memory/3372-18-0x0000000010000000-0x000000001019F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	sainbox.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	sainbox.exe

Executes dropped EXE 2 IoCs

pid	Process
2008	sainbox.exe
3372	sainbox.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sainbox.exe	6e9d7dbba6fcc3b5b270c36bfb02f8299541713a5db856ce578d241fe9b24475.exe
File opened for modification	C:\Windows\SysWOW64\sainbox.exe	6e9d7dbba6fcc3b5b270c36bfb02f8299541713a5db856ce578d241fe9b24475.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	sainbox.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	sainbox.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	sainbox.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3196	PING.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3372	sainbox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4960	6e9d7dbba6fcc3b5b270c36bfb02f8299541713a5db856ce578d241fe9b24475.exe
Token: SeLoadDriverPrivilege	3372	sainbox.exe
Token: 33	3372	sainbox.exe
Token: SeIncBasePriorityPrivilege	3372	sainbox.exe
Token: 33	3372	sainbox.exe
Token: SeIncBasePriorityPrivilege	3372	sainbox.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4476	4960	6e9d7dbba6fcc3b5b270c36bfb02f8299541713a5db856ce578d241fe9b24475.exe	89
PID 4960 wrote to memory of 4476	4960	6e9d7dbba6fcc3b5b270c36bfb02f8299541713a5db856ce578d241fe9b24475.exe	89
PID 4960 wrote to memory of 4476	4960	6e9d7dbba6fcc3b5b270c36bfb02f8299541713a5db856ce578d241fe9b24475.exe	89
PID 2008 wrote to memory of 3372	2008	sainbox.exe	90
PID 2008 wrote to memory of 3372	2008	sainbox.exe	90
PID 2008 wrote to memory of 3372	2008	sainbox.exe	90
PID 4476 wrote to memory of 3196	4476	cmd.exe	92
PID 4476 wrote to memory of 3196	4476	cmd.exe	92
PID 4476 wrote to memory of 3196	4476	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\6e9d7dbba6fcc3b5b270c36bfb02f8299541713a5db856ce578d241fe9b24475.exe
"C:\Users\Admin\AppData\Local\Temp\6e9d7dbba6fcc3b5b270c36bfb02f8299541713a5db856ce578d241fe9b24475.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\6E9D7D~1.EXE > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3196

C:\Windows\SysWOW64\sainbox.exe
C:\Windows\SysWOW64\sainbox.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\sainbox.exe
  C:\Windows\SysWOW64\sainbox.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sainbox.exe

Path C:\Windows\SysWOW64\sainbox.exe
Size 3.3MB
SHA256 23df6da0a34b6d9e451a23f8be86b22538f9e492cb10cba29bf673cc8137c02c
MD5 0410926798caf84091474762e52a0e22
SHA1 a06c4844263d5440fe55e8d7606ac24f574ea696
SHA512 728162c30e1a17039d96939afbe317d860b81d7481ae9a948b21ec2bb85b0e7ce302b0205d8fc55ef61e86852dd46fd83393f8e304e96585e1ff82261b88af33
SSDEEP 24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNHE:QHPkVOBTKk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2008-11-0x0000000010000000-0x000000001019F000-memory.dmp

Download

memory/3372-18-0x0000000010000000-0x000000001019F000-memory.dmp

Download

memory/4960-0-0x0000000010000000-0x000000001019F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads