gh0strat | a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599

General

Target

a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
Size

10.4MB
MD5

fedd9c69005255634a5da17680ec6675
SHA1

eac0e6815a2054af043635e7c826ac7f4b2e6be6
SHA256

a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599
SHA512

cead4080c4af314dbc74d86ce28da0fbd60385a2f3f625881cd0bd9f8ac9df921adab14200ade074c06724fd89895be26b8f39eb860a57b600025603eed2ac14
SSDEEP

196608:QKXbeO7E3ZDSBFB973PHBdBpvXvDTdBtB/jznPnDvDDlEfvr9vW0:p7iDYbP0v5vW0

Score

10^/10

gh0strat purplefox discovery persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 8 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral1/memory/2564-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2564-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2564-20-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2504-26-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2520-41-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2520-46-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2504-43-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2520-52-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 9 IoCs

Processes:

resource	yara_rule
\Windows\SysWOW64\259428960.txt	family_gh0strat
behavioral1/memory/2564-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2564-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2564-20-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2504-26-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2520-41-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2520-46-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2504-43-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2520-52-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Drops file in Drivers directory 1 IoCs

Processes:

TXPlatfor.exe

description ioc process

File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe

description	ioc	process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

TXPlatfor.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Executes dropped EXE 5 IoCs

Processes:

R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

pid process

2904 R.exe
2564 N.exe
2504 TXPlatfor.exe
2520 TXPlatfor.exe
2712 HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

pid	process
2904	R.exe
2564	N.exe
2504	TXPlatfor.exe
2520	TXPlatfor.exe
2712	HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

Loads dropped DLL 8 IoCs

Processes:

a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exeR.exeTXPlatfor.exeHD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

pid	process
2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
2904	R.exe
2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
2504	TXPlatfor.exe
2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
2712	HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
1256

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2564-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2564-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2564-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2564-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2504-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2520-41-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2520-46-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2504-43-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2520-52-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\kwallpaper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\kwallpaper.exe\" -autorun"	HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 3 IoCs

Processes:

R.exeN.exe

description	ioc	process
File created	C:\Windows\SysWOW64\259428960.txt	R.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

evasion

Processes:

HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\UserPreferencesMask = 9e3e078012000000	HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2392 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

pid process

2872 a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatfor.exe

pid process

2520 TXPlatfor.exe

pid	process
2392	PING.EXE

pid	process
2520	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

N.exeTXPlatfor.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2564	N.exe
Token: SeLoadDriverPrivilege	2520	TXPlatfor.exe
Token: 33	2520	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2520	TXPlatfor.exe
Token: 33	2520	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2520	TXPlatfor.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

pid	process
2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exeN.exeTXPlatfor.execmd.exe

description	pid	process	target process
PID 2872 wrote to memory of 2904	2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	R.exe
PID 2872 wrote to memory of 2904	2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	R.exe
PID 2872 wrote to memory of 2904	2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	R.exe
PID 2872 wrote to memory of 2904	2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	R.exe
PID 2872 wrote to memory of 2564	2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	N.exe
PID 2872 wrote to memory of 2564	2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	N.exe
PID 2872 wrote to memory of 2564	2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	N.exe
PID 2872 wrote to memory of 2564	2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	N.exe
PID 2872 wrote to memory of 2564	2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	N.exe
PID 2872 wrote to memory of 2564	2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	N.exe
PID 2872 wrote to memory of 2564	2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	N.exe
PID 2564 wrote to memory of 2576	2564	N.exe	cmd.exe
PID 2564 wrote to memory of 2576	2564	N.exe	cmd.exe
PID 2564 wrote to memory of 2576	2564	N.exe	cmd.exe
PID 2564 wrote to memory of 2576	2564	N.exe	cmd.exe
PID 2504 wrote to memory of 2520	2504	TXPlatfor.exe	TXPlatfor.exe
PID 2504 wrote to memory of 2520	2504	TXPlatfor.exe	TXPlatfor.exe
PID 2504 wrote to memory of 2520	2504	TXPlatfor.exe	TXPlatfor.exe
PID 2504 wrote to memory of 2520	2504	TXPlatfor.exe	TXPlatfor.exe
PID 2504 wrote to memory of 2520	2504	TXPlatfor.exe	TXPlatfor.exe
PID 2504 wrote to memory of 2520	2504	TXPlatfor.exe	TXPlatfor.exe
PID 2504 wrote to memory of 2520	2504	TXPlatfor.exe	TXPlatfor.exe
PID 2872 wrote to memory of 2712	2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
PID 2872 wrote to memory of 2712	2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
PID 2872 wrote to memory of 2712	2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
PID 2872 wrote to memory of 2712	2872	a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe	HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
PID 2576 wrote to memory of 2392	2576	cmd.exe	PING.EXE
PID 2576 wrote to memory of 2392	2576	cmd.exe	PING.EXE
PID 2576 wrote to memory of 2392	2576	cmd.exe	PING.EXE
PID 2576 wrote to memory of 2392	2576	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
"C:\Users\Admin\AppData\Local\Temp\a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872

C:\Users\Admin\AppData\Local\Temp\R.exe
C:\Users\Admin\AppData\Local\Temp\\R.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2904

C:\Users\Admin\AppData\Local\Temp\N.exe
C:\Users\Admin\AppData\Local\Temp\\N.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:2576

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:2392

C:\Users\Admin\AppData\Local\Temp\HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
C:\Users\Admin\AppData\Local\Temp\HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies Control Panel
PID:2712

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
3.6MB

MD5
cdf6f73bf5bb6aa69ec451088104dfe9

SHA1
83fa686a156e6bfe690220a77da670f8a0d63a2d

SHA256
c636f2c82b0e4bdb444b349dabe511b80c14eb23281b7ecd10cc861925be7126

SHA512
9a54ffc35cffc4f82f459d934528d9adfb9cf2aebf140d300bf491b52278f1f4160a1ba33a0ecdd6fab06c721fb6c263c941678f76ffa5b008833f39a01627ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_a3ebab0c8b0b613c2a96efc5cc628a31fc6548f7e68c86cb1eddfaa780340599.exe

Filesize
6.8MB

MD5
b83c56d82c2b33b2f91d46e343782dbc

SHA1
d9682dcce59598d18023ddc07fbc5798ac084e52

SHA256
4bf8147eb618a74579d649062ed57a8ed652695b4043a462f57f3edc6f6acf04

SHA512
096ad87e50a93dee171d331d590d48ae716a31f4fa18012d3ab3867d9cd308760b332f1bcc8db9876e9840b21bbe2256900206bc2f9527fef51ab3fba8422027

Download Submit
\Users\Admin\AppData\Local\Temp\N.exe

Filesize
377KB

MD5
4a36a48e58829c22381572b2040b6fe0

SHA1
f09d30e44ff7e3f20a5de307720f3ad148c6143b

SHA256
3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

SHA512
5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

Download Submit
\Users\Admin\AppData\Local\Temp\R.exe

Filesize
941KB

MD5
8dc3adf1c490211971c1e2325f1424d2

SHA1
4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5

SHA256
bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c

SHA512
ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

Download Submit
\Windows\SysWOW64\259428960.txt

Filesize
899KB

MD5
b9b0eac06665a7457c166c411a946598

SHA1
61ed20970b141a44c203ae9790fbbd98283c0311

SHA256
33fe73f6e8a16e1e1a7ce782eb47f5f188edcd73d3770f1e94803a7983fb9ba0

SHA512
00855c5ab78cee0aaae38bb7b23635635ac13581da23f51b4064f793e11627f79bfd2f2fe5b7d11dbc49aabf6e49e27806e1c002bc4e60d34981b17b10f06ff8

Download Submit
memory/2504-43-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2504-26-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2520-46-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2520-52-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2520-41-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2564-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2564-20-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2564-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2564-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads