gh0strat | ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb

General

Target

ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe
Size

3.2MB
MD5

0906d0b946da9d343fff0ff6502e9549
SHA1

4e10737783498cdd761eeb1b18edb76dfe28f814
SHA256

ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb
SHA512

74b7f01c20d212691ec2db6c614aa89f8fc0831d8217fc276b6807dba7f923db07776235473cbb3d6f7eea289988d6a3ef9f29225405066002d096a4b8eb4761
SSDEEP

98304:iZJt4HIZOgmhjdIOZ0yvcF62yTcieCVNn4rD18Xj/ca:IiIZO7VdIOZT2tiZT818Xj

Score

10^/10

gh0strat purplefox bootkit persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 8 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral1/memory/2372-9-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2372-8-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2372-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/3060-18-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/3060-36-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2552-35-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2552-50-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2552-56-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2372-9-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2372-8-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2372-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/3060-18-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2552-28-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/3060-36-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2552-35-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2552-50-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2552-56-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Drops file in Drivers directory 1 IoCs

Processes:

TXPlatforn.exe

description ioc process

File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe

description	ioc	process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

TXPlatforn.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 4 IoCs

Processes:

QQ.exeTXPlatforn.exeTXPlatforn.exeHD_ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe

pid process

2372 QQ.exe
3060 TXPlatforn.exe
2552 TXPlatforn.exe
2700 HD_ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe

pid	process
2372	QQ.exe
3060	TXPlatforn.exe
2552	TXPlatforn.exe
2700	HD_ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe

Loads dropped DLL 3 IoCs

Processes:

ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exeTXPlatforn.exe

pid	process
1936	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe
3060	TXPlatforn.exe
1936	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2372-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2372-9-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2372-8-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2372-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/3060-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2552-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/3060-36-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2552-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2552-50-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2552-56-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

HD_ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe

description ioc process

File opened for modification \??\PhysicalDrive0 HD_ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe
Drops file in System32 directory 2 IoCs

Processes:

QQ.exe

description ioc process

File created C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe QQ.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	HD_ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe

description	ioc	process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	QQ.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	QQ.exe

Drops file in Program Files directory 4 IoCs

Processes:

ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2512 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe

pid process

1936 ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatforn.exe

pid process

2552 TXPlatforn.exe

pid	process
2512	PING.EXE

pid	process
2552	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

QQ.exeTXPlatforn.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2372	QQ.exe
Token: SeLoadDriverPrivilege	2552	TXPlatforn.exe
Token: 33	2552	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2552	TXPlatforn.exe
Token: 33	2552	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2552	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe

pid	process
1936	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe
1936	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exeQQ.exeTXPlatforn.execmd.exe

description	pid	process	target process
PID 1936 wrote to memory of 2372	1936	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe	QQ.exe
PID 1936 wrote to memory of 2372	1936	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe	QQ.exe
PID 1936 wrote to memory of 2372	1936	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe	QQ.exe
PID 1936 wrote to memory of 2372	1936	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe	QQ.exe
PID 1936 wrote to memory of 2372	1936	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe	QQ.exe
PID 1936 wrote to memory of 2372	1936	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe	QQ.exe
PID 1936 wrote to memory of 2372	1936	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe	QQ.exe
PID 2372 wrote to memory of 2160	2372	QQ.exe	cmd.exe
PID 2372 wrote to memory of 2160	2372	QQ.exe	cmd.exe
PID 2372 wrote to memory of 2160	2372	QQ.exe	cmd.exe
PID 2372 wrote to memory of 2160	2372	QQ.exe	cmd.exe
PID 3060 wrote to memory of 2552	3060	TXPlatforn.exe	TXPlatforn.exe
PID 3060 wrote to memory of 2552	3060	TXPlatforn.exe	TXPlatforn.exe
PID 3060 wrote to memory of 2552	3060	TXPlatforn.exe	TXPlatforn.exe
PID 3060 wrote to memory of 2552	3060	TXPlatforn.exe	TXPlatforn.exe
PID 3060 wrote to memory of 2552	3060	TXPlatforn.exe	TXPlatforn.exe
PID 3060 wrote to memory of 2552	3060	TXPlatforn.exe	TXPlatforn.exe
PID 3060 wrote to memory of 2552	3060	TXPlatforn.exe	TXPlatforn.exe
PID 1936 wrote to memory of 2700	1936	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe	HD_ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe
PID 1936 wrote to memory of 2700	1936	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe	HD_ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe
PID 1936 wrote to memory of 2700	1936	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe	HD_ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe
PID 1936 wrote to memory of 2700	1936	ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe	HD_ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe
PID 2160 wrote to memory of 2512	2160	cmd.exe	PING.EXE
PID 2160 wrote to memory of 2512	2160	cmd.exe	PING.EXE
PID 2160 wrote to memory of 2512	2160	cmd.exe	PING.EXE
PID 2160 wrote to memory of 2512	2160	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe
"C:\Users\Admin\AppData\Local\Temp\ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936

C:\Users\Admin\AppData\Local\Temp\QQ.exe
C:\Users\Admin\AppData\Local\Temp\\QQ.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\QQ.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:2512

C:\Users\Admin\AppData\Local\Temp\HD_ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe
C:\Users\Admin\AppData\Local\Temp\HD_ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:2700

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.4MB

MD5
f82e5949c979df74c7d2f4cce0fff63d

SHA1
44ded2bf031512190ae4acdaadf98ccaa29c40fd

SHA256
ed9b3cef789fed45c81e0d9d7ed4577c0b09c8cc63ace1a9b928decf5c101843

SHA512
87c0fadfe72f065ca06968722020fd4e0c77655b0ac8500d20d9daa4a264a2468240a4df1116d4d763112729da896dcc0dc67ce6c85a37d6da25c317c13de891

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_ade73c82bf42a8127fa9a28b8c708a2bba5357f53f30491363e9afb36b2d58cb.exe

Filesize
1.8MB

MD5
b7cc9309601f70a44fded23dde33b865

SHA1
4f74a44c89922d025663f1694ad3bceb90dbfad7

SHA256
5cdcd9405a85f7ff3de0d91552d45c1df160d355e08999f18f2198bc856f7cc3

SHA512
f29cc7c131c9f3b61cfa6f1a04122a51a46745fb1744b53b2a4d1581af35a13a19b5df3f537774859f4a2089f0bf8806ffa5a53d4d829678539c4ef75ddb62e2

Download Submit
\Users\Admin\AppData\Local\Temp\QQ.exe

Filesize
377KB

MD5
3d6e7db5800f1dadb016cbf989749e3c

SHA1
7c09c438a352cbc4de5d7279bf07d36e8f6cbfef

SHA256
bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b

SHA512
a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c

Download Submit
memory/2372-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2372-9-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2372-8-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2372-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2552-28-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2552-35-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2552-50-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2552-56-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3060-36-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3060-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads