gh0strat | b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c

General

Target

b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
Size

10.7MB
MD5

96c72c12430ffdd8bc26af3760ce0565
SHA1

48b9041c751a8e6713b165dcbe91733b0a25c2eb
SHA256

b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c
SHA512

853c3d782410c76e7fe3973cb442e39418eea24836b29511863ca1f2d5367096e1f4dfea1fa9e47039f288caebfcb9799026bca31644d4807f999af2eb819034
SSDEEP

196608:SiINy2LkdvKtMLRDxolPc5il9PFLOyomFHKnP:7StMRDxkEiLPF

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 10 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral1/memory/2100-8-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2100-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2100-12-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2900-18-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2900-24-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2752-80-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2752-81-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2752-82-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2752-86-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2752-87-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2100-8-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2100-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2100-12-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2900-18-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2900-24-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2752-80-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2752-81-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2752-82-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2752-86-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2752-87-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Drops file in Drivers directory 1 IoCs

Processes:

TXPlatforn.exe

description ioc process

File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe

description	ioc	process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

TXPlatforn.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 4 IoCs

Processes:

RVN.exeTXPlatforn.exeTXPlatforn.exeHD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe

pid process

2100 RVN.exe
2900 TXPlatforn.exe
2752 TXPlatforn.exe
2692 HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe

pid	process
2100	RVN.exe
2900	TXPlatforn.exe
2752	TXPlatforn.exe
2692	HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe

Loads dropped DLL 7 IoCs

Processes:

b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exeTXPlatforn.exeWerFault.exe

pid	process
2972	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
2900	TXPlatforn.exe
2972	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
2732	WerFault.exe
2732	WerFault.exe
2732	WerFault.exe
2732	WerFault.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2100-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2100-8-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2100-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2100-12-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2900-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2900-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2752-80-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2752-78-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2752-81-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2752-82-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2752-86-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2752-87-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

Processes:

RVN.exe

description ioc process

File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe

description	ioc	process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

Drops file in Program Files directory 4 IoCs

Processes:

b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2876 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe

pid process

2972 b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatforn.exe

pid process

2752 TXPlatforn.exe

pid	process
2876	PING.EXE

pid	process
2752	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

RVN.exeTXPlatforn.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2100	RVN.exe
Token: SeLoadDriverPrivilege	2752	TXPlatforn.exe
Token: 33	2752	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2752	TXPlatforn.exe
Token: 33	2752	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2752	TXPlatforn.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe

pid	process
2692	HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
2692	HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe

pid process

2692 HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe

pid	process
2972	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
2972	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exeRVN.exeTXPlatforn.exeHD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.execmd.exe

description	pid	process	target process
PID 2972 wrote to memory of 2100	2972	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe	RVN.exe
PID 2972 wrote to memory of 2100	2972	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe	RVN.exe
PID 2972 wrote to memory of 2100	2972	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe	RVN.exe
PID 2972 wrote to memory of 2100	2972	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe	RVN.exe
PID 2972 wrote to memory of 2100	2972	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe	RVN.exe
PID 2972 wrote to memory of 2100	2972	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe	RVN.exe
PID 2972 wrote to memory of 2100	2972	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe	RVN.exe
PID 2100 wrote to memory of 2644	2100	RVN.exe	cmd.exe
PID 2100 wrote to memory of 2644	2100	RVN.exe	cmd.exe
PID 2100 wrote to memory of 2644	2100	RVN.exe	cmd.exe
PID 2100 wrote to memory of 2644	2100	RVN.exe	cmd.exe
PID 2900 wrote to memory of 2752	2900	TXPlatforn.exe	TXPlatforn.exe
PID 2900 wrote to memory of 2752	2900	TXPlatforn.exe	TXPlatforn.exe
PID 2900 wrote to memory of 2752	2900	TXPlatforn.exe	TXPlatforn.exe
PID 2900 wrote to memory of 2752	2900	TXPlatforn.exe	TXPlatforn.exe
PID 2900 wrote to memory of 2752	2900	TXPlatforn.exe	TXPlatforn.exe
PID 2900 wrote to memory of 2752	2900	TXPlatforn.exe	TXPlatforn.exe
PID 2900 wrote to memory of 2752	2900	TXPlatforn.exe	TXPlatforn.exe
PID 2972 wrote to memory of 2692	2972	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe	HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
PID 2972 wrote to memory of 2692	2972	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe	HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
PID 2972 wrote to memory of 2692	2972	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe	HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
PID 2972 wrote to memory of 2692	2972	b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe	HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
PID 2692 wrote to memory of 2732	2692	HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe	WerFault.exe
PID 2692 wrote to memory of 2732	2692	HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe	WerFault.exe
PID 2692 wrote to memory of 2732	2692	HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe	WerFault.exe
PID 2644 wrote to memory of 2876	2644	cmd.exe	PING.EXE
PID 2644 wrote to memory of 2876	2644	cmd.exe	PING.EXE
PID 2644 wrote to memory of 2876	2644	cmd.exe	PING.EXE
PID 2644 wrote to memory of 2876	2644	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
"C:\Users\Admin\AppData\Local\Temp\b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972

C:\Users\Admin\AppData\Local\Temp\RVN.exe
C:\Users\Admin\AppData\Local\Temp\\RVN.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:2644

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:2876

C:\Users\Admin\AppData\Local\Temp\HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
C:\Users\Admin\AppData\Local\Temp\HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2692 -s 224
3⤵
- Loads dropped DLL
PID:2732

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2752

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Impair Defenses

1

T1562

Disable or Modify Tools

1

T1562.001

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Filesize
1.1MB

MD5
48d31729db1dd573713343e7797d7671

SHA1
cc38dd77c49afe51d902b0fbf2fd196b6348d013

SHA256
455df602c0835a43a7cac0fa360fc6cb556ee0daf02680e152de8e44bdf5e2ac

SHA512
a07873f123330c5e67e78f4990c8ae6d28ff34107a5c17313949b126eff975ac7f16e3841c46212c304375e20e02bf8a1ae86ec73a19f84f5da4375c926cf3e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_b80d059881319d4a22c25c1a1f4577a7cd10e3bbe1d46ffa4287912e2587a59c.exe
Filesize
9.5MB

MD5
c818520973752a54d3b700ce9e63e075

SHA1
172d7d4cadd73b1de0a2e43b75b84edc61dbc080

SHA256
9ef52725d5380af3670f6e81b580d245f0fc9646eea41e33135be0d28d0532f3

SHA512
795825259420a0a882d66610234e134aff08dbc7160d4097d167b7bc16ff6cae69f1ae2fbaa2aebe0ea54480d10d179cf93bc8c848d4abd294870ddd56eaaebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\config.ini
Filesize
138B

MD5
2bc13da5cb7026a8a98cb64fbd4502a1

SHA1
731233695a390ce7c4f228974129f4fb6367230d

SHA256
5cda5c91dbfc10977367eaac03c55665d4f58a94dc9eebb9fbd33307ecb2276d

SHA512
67e6d0ced32cb65212e3e640f7c57c9fbe930549188014cd6f79205d84f598c6e8246fc6e04bcbcd122765a19aa26e74508924c74bee3491c402cfb1c9576cac

Download Submit
\Users\Admin\AppData\Local\Temp\RVN.exe
Filesize
377KB

MD5
80ade1893dec9cab7f2e63538a464fcc

SHA1
c06614da33a65eddb506db00a124a3fc3f5be02e

SHA256
57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

SHA512
fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

Download Submit
memory/2100-12-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2100-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2100-8-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2100-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2752-80-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2752-78-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2752-81-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2752-82-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2752-86-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2752-87-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2900-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2900-24-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads