gh0strat | 4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81

General

Target

4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe
Size

8.8MB
MD5

0cce02016cada3b29c6bc175b20b55b5
SHA1

eb51eb4e1c581b5a69d56a31f48115c4745764bd
SHA256

4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81
SHA512

a96bfc339d7abb7ade6672f5c19ab27cbb61aa58ebaf51721062c92afbb1e0486e3029aff9b0d549dac3fb708853f76da91f02b3b499d30a2dc8ac90c524fe56
SSDEEP

196608:8iINy2LkSPVIsfjruFlDoWRpEfsoCZTZ9WcP3AyOl/sJ:qPqsGF1b77oClZ9WXT

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 10 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/4992-10-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4992-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4992-6-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3360-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3360-23-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/772-30-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/772-37-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3360-17-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3360-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/772-38-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 11 IoCs

resource	yara_rule
behavioral2/memory/4992-10-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4992-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4992-6-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3360-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3360-23-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/772-24-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/772-30-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/772-37-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3360-17-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3360-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/772-38-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 4 IoCs

pid	Process
4992	RVN.exe
3360	TXPlatforn.exe
772	TXPlatforn.exe
3724	HD_4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4992-4-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4992-10-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4992-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4992-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3360-14-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3360-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3360-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/772-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/772-30-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/772-37-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3360-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3360-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/772-38-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3724	HD_4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4012	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4768	4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe
4768	4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
772	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4992	RVN.exe
Token: SeLoadDriverPrivilege	772	TXPlatforn.exe
Token: SeDebugPrivilege	3724	HD_4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe
Token: 33	772	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	772	TXPlatforn.exe
Token: 33	772	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	772	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4768	4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe
4768	4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe
3724	HD_4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4992	4768	4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe	82
PID 4768 wrote to memory of 4992	4768	4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe	82
PID 4768 wrote to memory of 4992	4768	4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe	82
PID 4992 wrote to memory of 4984	4992	RVN.exe	84
PID 4992 wrote to memory of 4984	4992	RVN.exe	84
PID 4992 wrote to memory of 4984	4992	RVN.exe	84
PID 3360 wrote to memory of 772	3360	TXPlatforn.exe	85
PID 3360 wrote to memory of 772	3360	TXPlatforn.exe	85
PID 3360 wrote to memory of 772	3360	TXPlatforn.exe	85
PID 4768 wrote to memory of 3724	4768	4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe	86
PID 4768 wrote to memory of 3724	4768	4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe	86
PID 4768 wrote to memory of 3724	4768	4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe	86
PID 4984 wrote to memory of 4012	4984	cmd.exe	89
PID 4984 wrote to memory of 4012	4984	cmd.exe	89
PID 4984 wrote to memory of 4012	4984	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe
"C:\Users\Admin\AppData\Local\Temp\4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\RVN.exe
  C:\Users\Admin\AppData\Local\Temp\\RVN.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4012
- C:\Users\Admin\AppData\Local\Temp\HD_4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe
  C:\Users\Admin\AppData\Local\Temp\HD_4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3724

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_4a94af56cafff9cb6c045db29bae5821dac2d101b779b37dd2c5a5e2f0dbbe81.exe

Filesize
7.4MB

MD5
0c90c402ac99975553c5a5e48c2cb93c

SHA1
48ae4b87ed94ab0b83429741f853ab2ce574e171

SHA256
0d169e38f9af0d411e4ad603fd796d43684ddb81622b8f50dddae9560942a167

SHA512
6e1e3d32e51ed7a162ce4cc776b29181c04db47c82d959500dc2bff448b716eb6cd5cada935df661a34fffee7367de352ee43ebaa9883db5a3aeb0a8a8eccd37

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.3MB

MD5
b3537be70a80217726ff246dfcbc8a0f

SHA1
830d2294571a058d23b9f06ba2676db37527d8db

SHA256
89bc1b1fbaef190624dc3416097663cc97a405a2c5853b59bad4694efdb53c53

SHA512
7c5f6f46acc14160a46a5d0f79c8751902f894089ff9db173f00ac0fbbad39ff963ee1e0691704ce4124f9cfe15e5e5c681047e3538c6e44251cae597632183e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RVN.exe

Filesize
377KB

MD5
80ade1893dec9cab7f2e63538a464fcc

SHA1
c06614da33a65eddb506db00a124a3fc3f5be02e

SHA256
57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

SHA512
fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

Download Submit
memory/772-24-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/772-38-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/772-37-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/772-30-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3360-14-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3360-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3360-23-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3360-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3360-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3724-83-0x0000000000400000-0x0000000000FE3000-memory.dmp

Filesize
11.9MB

Download
memory/3724-91-0x0000000000400000-0x0000000000FE3000-memory.dmp

Filesize
11.9MB

Download
memory/3724-36-0x0000000002D40000-0x0000000002EE7000-memory.dmp

Filesize
1.7MB

Download
memory/3724-33-0x0000000000400000-0x0000000000FE3000-memory.dmp

Filesize
11.9MB

Download
memory/3724-32-0x0000000002D40000-0x0000000002EE7000-memory.dmp

Filesize
1.7MB

Download
memory/4992-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4992-4-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4992-10-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4992-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads