gh0strat | 2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b

General

Target

2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b.exe
Size

1.8MB
MD5

c3c737f1b756b914cfec10ec0a843232
SHA1

84830acae6323930c00d8dc79d2efbac82018d02
SHA256

2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b
SHA512

b49071a461c0ad17bcfb5d6be88a3515f9e0e724663df7de463102eec1a7a173c002d0e22b61b7231417a0cd48c7a7ac9456a58a7e8c54099cfec9e940771bbe
SSDEEP

24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNuukEp3W8AD/Dhd+y4lqJ8QdCYDoDNK6:QHPkVOBTKdsvD/DX+y4onCYDoD5

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 2 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral1/memory/2356-0-0x0000000010000000-0x000000001019F000-memory.dmp	purplefox_rootkit
behavioral1/memory/1596-18-0x0000000010000000-0x000000001019F000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2356-0-0x0000000010000000-0x000000001019F000-memory.dmp	family_gh0strat
behavioral1/memory/1596-18-0x0000000010000000-0x000000001019F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Drops file in Drivers directory 1 IoCs

Processes:

Aqiyq.exe

description ioc process

File created C:\Windows\system32\drivers\QAssist.sys Aqiyq.exe
Sets service image path in registry 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

Aqiyq.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Aqiyq.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

3040 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

Aqiyq.exeAqiyq.exe

pid process

2024 Aqiyq.exe
1596 Aqiyq.exe
Loads dropped DLL 1 IoCs

Processes:

Aqiyq.exe

pid process

2024 Aqiyq.exe

description	ioc	process
File created	C:\Windows\system32\drivers\QAssist.sys	Aqiyq.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	Aqiyq.exe

pid	process
3040	cmd.exe

pid	process
2024	Aqiyq.exe
1596	Aqiyq.exe

pid	process
2024	Aqiyq.exe

Drops file in System32 directory 2 IoCs

Processes:

2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Aqiyq.exe	2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b.exe
File opened for modification	C:\Windows\SysWOW64\Aqiyq.exe	2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b.exe

Modifies data under HKEY_USERS 4 IoCs

Processes:

Aqiyq.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Aqiyq.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Aqiyq.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Aqiyq.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Aqiyq.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2688 PING.EXE
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

Aqiyq.exe

pid process

1596 Aqiyq.exe

pid	process
2688	PING.EXE

pid	process
1596	Aqiyq.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b.exeAqiyq.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2356	2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b.exe
Token: SeLoadDriverPrivilege	1596	Aqiyq.exe
Token: 33	1596	Aqiyq.exe
Token: SeIncBasePriorityPrivilege	1596	Aqiyq.exe
Token: 33	1596	Aqiyq.exe
Token: SeIncBasePriorityPrivilege	1596	Aqiyq.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b.exeAqiyq.execmd.exe

description	pid	process	target process
PID 2356 wrote to memory of 3040	2356	2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b.exe	cmd.exe
PID 2356 wrote to memory of 3040	2356	2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b.exe	cmd.exe
PID 2356 wrote to memory of 3040	2356	2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b.exe	cmd.exe
PID 2356 wrote to memory of 3040	2356	2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b.exe	cmd.exe
PID 2024 wrote to memory of 1596	2024	Aqiyq.exe	Aqiyq.exe
PID 2024 wrote to memory of 1596	2024	Aqiyq.exe	Aqiyq.exe
PID 2024 wrote to memory of 1596	2024	Aqiyq.exe	Aqiyq.exe
PID 2024 wrote to memory of 1596	2024	Aqiyq.exe	Aqiyq.exe
PID 3040 wrote to memory of 2688	3040	cmd.exe	PING.EXE
PID 3040 wrote to memory of 2688	3040	cmd.exe	PING.EXE
PID 3040 wrote to memory of 2688	3040	cmd.exe	PING.EXE
PID 3040 wrote to memory of 2688	3040	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b.exe
"C:\Users\Admin\AppData\Local\Temp\2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\2EB44E~1.EXE > nul
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
3⤵
- Runs ping.exe
PID:2688

C:\Windows\SysWOW64\Aqiyq.exe
C:\Windows\SysWOW64\Aqiyq.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\Aqiyq.exe
C:\Windows\SysWOW64\Aqiyq.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1596

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aqiyq.exe
Filesize
1.8MB

MD5
c3c737f1b756b914cfec10ec0a843232

SHA1
84830acae6323930c00d8dc79d2efbac82018d02

SHA256
2eb44e48e0a2d65e057551b77af0d10e50de6851a6c6ecc6de5cac9841e5e98b

SHA512
b49071a461c0ad17bcfb5d6be88a3515f9e0e724663df7de463102eec1a7a173c002d0e22b61b7231417a0cd48c7a7ac9456a58a7e8c54099cfec9e940771bbe

Download Submit
memory/1596-18-0x0000000010000000-0x000000001019F000-memory.dmp

Filesize
1.6MB

Download
memory/2356-0-0x0000000010000000-0x000000001019F000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads