gh0strat | a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe
Size

6.5MB
MD5

9b992710ae2b1b86467b98166596b332
SHA1

83a0d21a51a44879d4a217766ef3808c57248802
SHA256

a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca
SHA512

cf4ab7c05248faf85bd115bc159c39131da4f1ad0d1b4a66a8dd42de52f563ac4a302f379451494f60d5dbbc4281a291e0a398ae9692ef82515169ec8996ad31
SSDEEP

98304:9ws2ANnKXOaeOgmhbi1BTutTbpZNl9CHkVVK4fjZbcVQ7/1s3Jlvs:nKXbeO7c1pgbP/9ak/K4fjZbc6/m3Ps

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 8 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral2/memory/2232-19-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2232-23-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2232-18-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/668-29-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/668-28-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4744-35-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4744-42-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4744-45-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 9 IoCs

Processes:

resource	yara_rule
C:\Windows\SysWOW64\240603859.txt	family_gh0strat
behavioral2/memory/2232-19-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2232-23-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2232-18-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/668-29-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/668-28-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4744-35-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4744-42-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4744-45-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Drops file in Drivers directory 1 IoCs

Processes:

TXPlatfor.exe

description ioc process

File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe

description	ioc	process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

R.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240603859.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

TXPlatfor.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 6 IoCs

Processes:

R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exeRemote Data.exe

pid	process
4628	R.exe
2232	N.exe
668	TXPlatfor.exe
4744	TXPlatfor.exe
760	HD_a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe
4452	Remote Data.exe

Loads dropped DLL 5 IoCs

Processes:

R.exesvchost.exeHD_a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exeRemote Data.exe

pid	process
4628	R.exe
4916	svchost.exe
760	HD_a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe
760	HD_a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe
4452	Remote Data.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2232-19-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2232-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2232-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2232-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/668-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/668-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/668-27-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4744-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4744-42-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4744-45-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in System32 directory 6 IoCs

Processes:

R.exesvchost.exeN.exe

description	ioc	process
File created	C:\Windows\SysWOW64\240603859.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe

Drops file in Program Files directory 1 IoCs

Processes:

a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4252 PING.EXE

pid	process
4252	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exeHD_a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe

pid	process
1920	a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe
1920	a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe
760	HD_a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe
760	HD_a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatfor.exe

pid process

4744 TXPlatfor.exe

pid	process
4744	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

N.exeTXPlatfor.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2232	N.exe
Token: SeLoadDriverPrivilege	4744	TXPlatfor.exe
Token: 33	4744	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	4744	TXPlatfor.exe
Token: 33	4744	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	4744	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe

pid	process
1920	a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe
1920	a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exeN.exeTXPlatfor.execmd.exesvchost.exe

description	pid	process	target process
PID 1920 wrote to memory of 4628	1920	a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe	R.exe
PID 1920 wrote to memory of 4628	1920	a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe	R.exe
PID 1920 wrote to memory of 4628	1920	a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe	R.exe
PID 1920 wrote to memory of 2232	1920	a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe	N.exe
PID 1920 wrote to memory of 2232	1920	a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe	N.exe
PID 1920 wrote to memory of 2232	1920	a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe	N.exe
PID 2232 wrote to memory of 1420	2232	N.exe	cmd.exe
PID 2232 wrote to memory of 1420	2232	N.exe	cmd.exe
PID 2232 wrote to memory of 1420	2232	N.exe	cmd.exe
PID 668 wrote to memory of 4744	668	TXPlatfor.exe	TXPlatfor.exe
PID 668 wrote to memory of 4744	668	TXPlatfor.exe	TXPlatfor.exe
PID 668 wrote to memory of 4744	668	TXPlatfor.exe	TXPlatfor.exe
PID 1920 wrote to memory of 760	1920	a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe	HD_a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe
PID 1920 wrote to memory of 760	1920	a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe	HD_a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe
PID 1920 wrote to memory of 760	1920	a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe	HD_a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe
PID 1420 wrote to memory of 4252	1420	cmd.exe	PING.EXE
PID 1420 wrote to memory of 4252	1420	cmd.exe	PING.EXE
PID 1420 wrote to memory of 4252	1420	cmd.exe	PING.EXE
PID 4916 wrote to memory of 4452	4916	svchost.exe	Remote Data.exe
PID 4916 wrote to memory of 4452	4916	svchost.exe	Remote Data.exe
PID 4916 wrote to memory of 4452	4916	svchost.exe	Remote Data.exe

C:\Users\Admin\AppData\Local\Temp\a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe
"C:\Users\Admin\AppData\Local\Temp\a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920

C:\Users\Admin\AppData\Local\Temp\R.exe
C:\Users\Admin\AppData\Local\Temp\\R.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:4628

C:\Users\Admin\AppData\Local\Temp\N.exe
C:\Users\Admin\AppData\Local\Temp\\N.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:1420

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:4252

C:\Users\Admin\AppData\Local\Temp\HD_a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe
C:\Users\Admin\AppData\Local\Temp\HD_a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:760

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:3192

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4916

C:\Windows\SysWOW64\Remote Data.exe
"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240603859.txt",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4452

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
2.7MB

MD5
f47ede11569972294f0c6e14abc1ed5d

SHA1
716f0395d5ed6471f333bb637bf6616f99f778c1

SHA256
64d4b87645b0ad7850630bef449028267167a263697f7349345ae263d1ad19e7

SHA512
01b9065a2bbce1b03693d7ddeb8238d32db8387e3a33cbe4dd0faa403e071f123d2369681c5920badb806c4fec8a1e27bd3b0fa9736223697a64e816fb134419

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_a1c57aea0752e05a55e8b6ac9093368701c7035961bc49177af9d08e50fcb0ca.exe

Filesize
3.8MB

MD5
3e7de17d67e8780a2f7ecda10cd31f7e

SHA1
0d54f920ac02e2fade9ffb5d517b7f3474d0df0f

SHA256
1043172fa3e173da7bd3f74c207202085c3dff4e816150d9a244956d6b4d0eba

SHA512
8da38aec893457bd2712268e16cbf6fff93096780c0e8ac61fddf70533fada8c96e3411a75e3619fd1529e6a1a450f6c8c60cce9b6d2691b2333d4a1548dad15

Download Submit
C:\Users\Admin\AppData\Local\Temp\N.exe

Filesize
377KB

MD5
4a36a48e58829c22381572b2040b6fe0

SHA1
f09d30e44ff7e3f20a5de307720f3ad148c6143b

SHA256
3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

SHA512
5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\R.exe

Filesize
941KB

MD5
8dc3adf1c490211971c1e2325f1424d2

SHA1
4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5

SHA256
bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c

SHA512
ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc58DF.tmp\FindProcDLL.dll

Filesize
27KB

MD5
6f73b00aef6c49eac62128ef3eca677e

SHA1
1b6aff67d570e5ee61af2376247590eb49b728a1

SHA256
6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9

SHA512
678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc58DF.tmp\InstallOptions.dll

Filesize
15KB

MD5
89351a0a6a89519c86c5531e20dab9ea

SHA1
9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00

SHA256
f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277

SHA512
13168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc58DF.tmp\ioSpecial.ini

Filesize
1KB

MD5
26e4da12847631be5192f623dc20458f

SHA1
5c285f5112a6796ca6697c3aac2f268e4331e5f1

SHA256
23f689aef20c8c98ee94b84a1be33846eb054b076ebe113141c14baba57583e1

SHA512
e41a92102669c720df4587854c5a61cbf80cd9de01d4b49c2e5490eb6d7ac5851c4f65c0804c6881b3749c29aadc6335902ecc625d09e76323c41c68a0a4a805

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc58DF.tmp\ioSpecial.ini

Filesize
1KB

MD5
2092cab720e3febbee449327bb0d344e

SHA1
27a348fa4a3839945ff9ba2ed6c3f74a96389627

SHA256
41cdf5dfe53d6e142e6de1a4d0078e7e24b15a55392480dd77845ac19c7cd52f

SHA512
70895d66e04fa95d6ed74c85d1efbddd67b3f880e95d8be5c8d32287e85102e02dd529ab19d982bf10c50382c8bdd29c43b1f308f970351942cc1b55604b0148

Download Submit
C:\Windows\SysWOW64\240603859.txt

Filesize
899KB

MD5
93e73942b2969dc07c939b71f6d2e50f

SHA1
cd95522c60c48372ead7e94f41b7af7859522396

SHA256
d2d6f84758cd85c2cb00ee9a0db104aa99cf0def849f700e437d8b10f2b69c39

SHA512
fc46cf1a68deb408b0095531f0ecc4f20b230e3f6afeef2669600e7010cb245580c765c24551a266969ae33c44620efb16c76642cb2b5c584817c00f5d28e937

Download Submit
C:\Windows\SysWOW64\Remote Data.exe

Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit
memory/668-27-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/668-28-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/668-29-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2232-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2232-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2232-23-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2232-19-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4744-45-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4744-42-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4744-35-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download