gh0strat | 11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986

General

Target

11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
Size

2.9MB
MD5

0b8aa616bcc8c9c27924c79ead14d089
SHA1

4b271ae81d4e9340d91c433c682029b3c588cc60
SHA256

11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986
SHA512

19f434716a4baf845a6074f54a76cc395ffa984e37dc8dfb59ae6222ae503b2f6423a66b18d8ff2b1841e1df096d9f11a60347ae903b14307959a74475297e31
SSDEEP

49152:k09XJt4HIN2H2tFvduyShspoZ/Pjb6Kt0rbJEuSLz5xXA:JZJt4HINy2LkhsqZ6K+mLzA

Score

10^/10

gh0strat purplefox bootkit discovery persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 10 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral2/memory/60-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/60-10-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/60-6-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/900-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/900-19-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/900-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/900-24-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1652-35-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1652-39-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1652-40-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 10 IoCs

Processes:

resource	yara_rule
behavioral2/memory/60-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/60-10-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/60-6-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/900-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/900-19-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/900-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/900-24-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1652-35-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1652-39-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1652-40-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Drops file in Drivers directory 1 IoCs

Processes:

TXPlatforn.exe

description ioc process

File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe

description	ioc	process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

TXPlatforn.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 4 IoCs

Processes:

RVN.exeTXPlatforn.exeHD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exeTXPlatforn.exe

pid process

60 RVN.exe
900 TXPlatforn.exe
3108 HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
1652 TXPlatforn.exe

pid	process
60	RVN.exe
900	TXPlatforn.exe
3108	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
1652	TXPlatforn.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/60-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/60-10-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/60-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/60-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/900-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/900-19-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/900-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/900-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/900-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1652-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1652-39-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1652-40-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe

description ioc process

File opened for modification \??\PhysicalDrive0 HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
Drops file in System32 directory 2 IoCs

Processes:

RVN.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe
File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

Drops file in Program Files directory 5 IoCs

Processes:

11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DesktopBackground\Shell\整理桌面\Icon = "\\Utils\\Install.ico"	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DesktopBackground\Shell\整理桌面\Position = "Top"	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DesktopBackground\shell\整理桌面\command	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\jiandesk\ = "映射该文件夹到桌面"	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DesktopBackground\shell\整理桌面	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DesktopBackground\Shell\整理桌面\command\ = "\\JDeskTray.exe --from=rmenu"	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\jiandesk	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\jiandesk\Icon = "\\Utils\\mirror.ico"	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\jiandesk\command	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\jiandesk\command\ = "\\DeskAide64.exe --from=rmenu --mirrorPath=\"%1\""	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2472 PING.EXE

pid	process
2472	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exeHD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe

pid	process
3672	11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
3672	11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
3108	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
3108	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatforn.exe

pid process

1652 TXPlatforn.exe

pid	process
1652	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

RVN.exeTXPlatforn.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	60	RVN.exe
Token: SeLoadDriverPrivilege	1652	TXPlatforn.exe
Token: 33	1652	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	1652	TXPlatforn.exe
Token: 33	1652	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	1652	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe

pid	process
3672	11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
3672	11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exeRVN.exeTXPlatforn.execmd.exe

description	pid	process	target process
PID 3672 wrote to memory of 60	3672	11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe	RVN.exe
PID 3672 wrote to memory of 60	3672	11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe	RVN.exe
PID 3672 wrote to memory of 60	3672	11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe	RVN.exe
PID 60 wrote to memory of 3580	60	RVN.exe	cmd.exe
PID 60 wrote to memory of 3580	60	RVN.exe	cmd.exe
PID 60 wrote to memory of 3580	60	RVN.exe	cmd.exe
PID 3672 wrote to memory of 3108	3672	11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
PID 3672 wrote to memory of 3108	3672	11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
PID 3672 wrote to memory of 3108	3672	11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe	HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
PID 900 wrote to memory of 1652	900	TXPlatforn.exe	TXPlatforn.exe
PID 900 wrote to memory of 1652	900	TXPlatforn.exe	TXPlatforn.exe
PID 900 wrote to memory of 1652	900	TXPlatforn.exe	TXPlatforn.exe
PID 3580 wrote to memory of 2472	3580	cmd.exe	PING.EXE
PID 3580 wrote to memory of 2472	3580	cmd.exe	PING.EXE
PID 3580 wrote to memory of 2472	3580	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
"C:\Users\Admin\AppData\Local\Temp\11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672

C:\Users\Admin\AppData\Local\Temp\RVN.exe
C:\Users\Admin\AppData\Local\Temp\\RVN.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:60

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:3580

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:2472

C:\Users\Admin\AppData\Local\Temp\HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
C:\Users\Admin\AppData\Local\Temp\HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3108

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986.exe

Filesize
1.3MB

MD5
0180d6e451c4b289bcc4d8be163bd9ad

SHA1
3f288c137b7d142db11180d2822fe680fdfe85fd

SHA256
1a9b3c81a7598f942e9c030bd452bac5a97c7ca528e5f575442a55cf836f02ef

SHA512
8fa31cc994b598e2f555341a3b8942d99fee92c9b10f955f9ff13c1a4ab8adec126a9d5fd8103d703171d532725a72ca91cc788dd22d3e77d6e7ab7e54e2ab4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.5MB

MD5
b953626a0e4e08ef341d05af6cb34232

SHA1
f254d1ed89204b1c284d904cc34381ed5a0dae29

SHA256
9348820216f0d99083c8186a5f7e3d3d2dd6595367f64fbba12a58afba259b37

SHA512
d30cbad419c357a0dc2a9097c6e399597bfaec6c8231288f3f907941984111282c93f8b121ae739ae6192ffcf1d9fe38b3d0e9e527560f8be0c04c71046e74fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\RVN.exe

Filesize
377KB

MD5
80ade1893dec9cab7f2e63538a464fcc

SHA1
c06614da33a65eddb506db00a124a3fc3f5be02e

SHA256
57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

SHA512
fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

Download Submit
memory/60-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/60-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/60-10-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/60-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/900-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/900-19-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/900-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/900-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/900-24-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1652-35-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1652-39-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1652-40-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads