gh0strat | 45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f

General

Target

45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
Size

6.6MB
MD5

a3a07116e21956651ef95ef5ef672039
SHA1

cc7053fe3282d67e116de5302d9e5715dfdc3543
SHA256

45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f
SHA512

e7778afe1265783bc24f84ea7e5318852af5d910689938d83eef3e615a80d414c9cb73c91bebeea9be9036ac63ec5d1e7bbbe633c9dc5268befe29ced22917fd
SSDEEP

98304:ZZJt4HINy2LkUWS/UPp7C04/bHvJI85FOy5kbhx107gvwk7:7iINy2LkPS/oNCH7J3rt0hx1Ok7

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 9 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral1/memory/3040-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/3040-12-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/3040-8-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2608-18-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2524-26-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2524-40-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2524-36-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2608-29-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2524-82-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3040-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/3040-12-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/3040-8-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2608-18-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2524-26-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2524-40-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2524-36-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2608-29-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2524-82-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Drops file in Drivers directory 1 IoCs

Processes:

TXPlatforn.exe

description ioc process

File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe

description	ioc	process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

TXPlatforn.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 4 IoCs

Processes:

RVN.exeTXPlatforn.exeTXPlatforn.exeHD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe

pid process

3040 RVN.exe
2608 TXPlatforn.exe
2524 TXPlatforn.exe
2428 HD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe

pid	process
3040	RVN.exe
2608	TXPlatforn.exe
2524	TXPlatforn.exe
2428	HD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe

Loads dropped DLL 4 IoCs

Processes:

45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exeTXPlatforn.exe

pid	process
1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
2608	TXPlatforn.exe
1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3040-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/3040-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/3040-12-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/3040-8-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2608-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2524-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2524-40-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2524-36-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2608-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2524-82-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

Processes:

RVN.exe

description ioc process

File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

HD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe

pid process

2428 HD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe

description	ioc	process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

pid	process
2428	HD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe

Drops file in Program Files directory 4 IoCs

Processes:

45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2900 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe

pid process

1888 45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatforn.exe

pid process

2524 TXPlatforn.exe

pid	process
2900	PING.EXE

pid	process
2524	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

RVN.exeHD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exeTXPlatforn.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	3040	RVN.exe
Token: SeDebugPrivilege	2428	HD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
Token: SeDebugPrivilege	2428	HD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
Token: SeLoadDriverPrivilege	2524	TXPlatforn.exe
Token: 33	2524	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2524	TXPlatforn.exe
Token: 33	2524	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2524	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exeHD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe

pid	process
1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
2428	HD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exeRVN.exeTXPlatforn.execmd.exe

description	pid	process	target process
PID 1888 wrote to memory of 3040	1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe	RVN.exe
PID 1888 wrote to memory of 3040	1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe	RVN.exe
PID 1888 wrote to memory of 3040	1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe	RVN.exe
PID 1888 wrote to memory of 3040	1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe	RVN.exe
PID 1888 wrote to memory of 3040	1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe	RVN.exe
PID 1888 wrote to memory of 3040	1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe	RVN.exe
PID 1888 wrote to memory of 3040	1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe	RVN.exe
PID 3040 wrote to memory of 2516	3040	RVN.exe	cmd.exe
PID 3040 wrote to memory of 2516	3040	RVN.exe	cmd.exe
PID 3040 wrote to memory of 2516	3040	RVN.exe	cmd.exe
PID 3040 wrote to memory of 2516	3040	RVN.exe	cmd.exe
PID 2608 wrote to memory of 2524	2608	TXPlatforn.exe	TXPlatforn.exe
PID 2608 wrote to memory of 2524	2608	TXPlatforn.exe	TXPlatforn.exe
PID 2608 wrote to memory of 2524	2608	TXPlatforn.exe	TXPlatforn.exe
PID 2608 wrote to memory of 2524	2608	TXPlatforn.exe	TXPlatforn.exe
PID 2608 wrote to memory of 2524	2608	TXPlatforn.exe	TXPlatforn.exe
PID 2608 wrote to memory of 2524	2608	TXPlatforn.exe	TXPlatforn.exe
PID 2608 wrote to memory of 2524	2608	TXPlatforn.exe	TXPlatforn.exe
PID 1888 wrote to memory of 2428	1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe	HD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
PID 1888 wrote to memory of 2428	1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe	HD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
PID 1888 wrote to memory of 2428	1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe	HD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
PID 1888 wrote to memory of 2428	1888	45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe	HD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
PID 2516 wrote to memory of 2900	2516	cmd.exe	PING.EXE
PID 2516 wrote to memory of 2900	2516	cmd.exe	PING.EXE
PID 2516 wrote to memory of 2900	2516	cmd.exe	PING.EXE
PID 2516 wrote to memory of 2900	2516	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
"C:\Users\Admin\AppData\Local\Temp\45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888

C:\Users\Admin\AppData\Local\Temp\RVN.exe
C:\Users\Admin\AppData\Local\Temp\\RVN.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:2516

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:2900

C:\Users\Admin\AppData\Local\Temp\HD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
C:\Users\Admin\AppData\Local\Temp\HD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2428

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2524

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Filesize
1.5MB

MD5
431b9376455ed1f4ef13f5b0adec4287

SHA1
d3400c54f31ce6751a1523c369ac5d9950cb0c0a

SHA256
63b031e2c42b6d1938ea65cbee8ae46064cc6b28aaa7666f551d97ddd319fdfa

SHA512
5a62f47c6dc542d8a5bdfc28ee17c96b92c0e8ee4e6eec2b56c71f64a4504ca8375cefa109155906d3c8e68ae9002b046cfdd5abc2718bf4640813af63be4ef4

Download Submit
\Users\Admin\AppData\Local\Temp\HD_45916b1934b75a258cbfbd67598e428db441897755bc5c266f61c475025a0c5f.exe
Filesize
5.1MB

MD5
1ced09682c5544af9345200092f23a65

SHA1
1c9c94358ff7805d238bad4129f1adc3ca5c044c

SHA256
5382a7edfb4c424ebaa4c39cd2c2caaf2d8bff111a46ad59c6bc8818789e9073

SHA512
0a532b5007d4167d467bba3cc88dd7dfc428e2b14552a6a6379bb8040b11cc1920ee81fc33259961bbe0ed4c2f6d4f3bf7bb2baffcd9edce0769e7fdbef189d5

Download Submit
\Users\Admin\AppData\Local\Temp\RVN.exe
Filesize
377KB

MD5
80ade1893dec9cab7f2e63538a464fcc

SHA1
c06614da33a65eddb506db00a124a3fc3f5be02e

SHA256
57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

SHA512
fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

Download Submit
memory/1888-83-0x00000000038D0000-0x0000000003E16000-memory.dmp

Filesize
5.3MB

Download
memory/2428-42-0x0000000000230000-0x0000000000302000-memory.dmp

Filesize
840KB

Download
memory/2428-49-0x0000000000400000-0x0000000000946000-memory.dmp

Filesize
5.3MB

Download
memory/2524-26-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2524-40-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2524-36-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2524-82-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2608-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2608-29-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3040-8-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3040-12-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3040-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3040-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads