gh0strat | 7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe
Size 1.6MB
Sample240528-2qf7bagg59
SHA256 7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940
MD5 06cf145b2546ab3b5dd67a4ab30983ff
SHA1 a1905fa88dcc2afd5808e9656546d4fe82ffe989
SHA512 d64f732cc5e753297517b9f7e335238163db9f7b36cbb84e1580bbe62ae9fd16b88f8885e3f1f957cff63509259ad39670b24ae30a7987ba78bef929244dabab
SSDEEP 24576:i89tv9/7JtDElDEExIecl1erdg0MCiVWhR/adrEE7:i89XJt4HIZ/Gg0P+WhkdrT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 10 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/3316-6-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3316-10-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3316-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1268-17-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1268-29-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2128-42-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2128-50-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1268-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1268-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2128-82-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 10 IoCs

resource	yara_rule
behavioral2/memory/3316-6-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3316-10-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3316-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1268-17-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1268-29-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2128-42-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2128-50-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1268-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1268-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2128-82-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 7 IoCs

pid	Process
3316	QQ.exe
1268	TXPlatforn.exe
1560	HD_7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe
2128	TXPlatforn.exe
3144	QQ.exe
2736	TXPlatforn.exe
436	TXPlatforn.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3316-4-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3316-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3316-10-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3316-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1268-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1268-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1268-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2128-42-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2128-50-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1268-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1268-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2128-82-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	QQ.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	QQ.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2704	PING.EXE
1532	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3004	7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe
3004	7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2128	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3316	QQ.exe
Token: SeIncBasePriorityPrivilege	3144	QQ.exe
Token: SeLoadDriverPrivilege	2128	TXPlatforn.exe
Token: 33	2128	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2128	TXPlatforn.exe
Token: 33	2128	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2128	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3004	7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe
3004	7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3316	3004	7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe	82
PID 3004 wrote to memory of 3316	3004	7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe	82
PID 3004 wrote to memory of 3316	3004	7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe	82
PID 3316 wrote to memory of 4708	3316	QQ.exe	84
PID 3316 wrote to memory of 4708	3316	QQ.exe	84
PID 3316 wrote to memory of 4708	3316	QQ.exe	84
PID 3004 wrote to memory of 1560	3004	7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe	85
PID 3004 wrote to memory of 1560	3004	7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe	85
PID 3004 wrote to memory of 1560	3004	7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe	85
PID 1268 wrote to memory of 2128	1268	TXPlatforn.exe	86
PID 1268 wrote to memory of 2128	1268	TXPlatforn.exe	86
PID 1268 wrote to memory of 2128	1268	TXPlatforn.exe	86
PID 1560 wrote to memory of 3144	1560	HD_7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe	87
PID 1560 wrote to memory of 3144	1560	HD_7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe	87
PID 1560 wrote to memory of 3144	1560	HD_7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe	87
PID 3144 wrote to memory of 4728	3144	QQ.exe	89
PID 3144 wrote to memory of 4728	3144	QQ.exe	89
PID 3144 wrote to memory of 4728	3144	QQ.exe	89
PID 2736 wrote to memory of 436	2736	TXPlatforn.exe	90
PID 2736 wrote to memory of 436	2736	TXPlatforn.exe	90
PID 2736 wrote to memory of 436	2736	TXPlatforn.exe	90
PID 4728 wrote to memory of 1532	4728	cmd.exe	94
PID 4728 wrote to memory of 1532	4728	cmd.exe	94
PID 4728 wrote to memory of 1532	4728	cmd.exe	94
PID 4708 wrote to memory of 2704	4708	cmd.exe	95
PID 4708 wrote to memory of 2704	4708	cmd.exe	95
PID 4708 wrote to memory of 2704	4708	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe
"C:\Users\Admin\AppData\Local\Temp\7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\QQ.exe
  C:\Users\Admin\AppData\Local\Temp\\QQ.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\QQ.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2704
- C:\Users\Admin\AppData\Local\Temp\HD_7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe
  C:\Users\Admin\AppData\Local\Temp\HD_7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Users\Admin\AppData\Local\Temp\QQ.exe
    "C:\Users\Admin\AppData\Local\Temp\QQ.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\QQ.exe > nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4728
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 127.0.0.1
        5⤵
        Runs ping.exe
        
        PID:1532

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:2128

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Executes dropped EXE
  PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_7f8778d6577836d566a57a19d2f1b07bf265663beacc76e6a346fce0b7953940.exe
Size 60KB
SHA256 16cad587efa53f2ee5e012f98633fe8fe44123ae2f27e209d346fc25657042b6
MD5 6706ad61ca22ca189aa7baaf58ae1c26
SHA1 47c19ac84a36b905f432333d140b989b15e8f0f8
SHA512 59fc9cddc0bf4d8d3bbd78bf41d772717f8fb881fc6ade0e2ab340ffc85778afa1a567d75d6a00cfdcd71850b7bf90aefa6395b3b2f6e3ea270b06ed88a90b6d
SSDEEP 768:VXZTgg7qRrkVr2A91o6Vkp+SKYyN7vaBa0bFDRGLpTHypa4Lw2MlLDGAAMxkEDt:FRgg2Vkx9fukSaErDY1Tp4EjTxt
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.5MB
SHA256 0d74b8eb0b7726e6f3dc00f02f074f456ddbceb4b60381d145a12b6ceedceebf
MD5 229eea9264cf6c55bfc4aab792550bd8
SHA1 6f859c624e85d9cb12c3803b36c096e59c86133a
SHA512 fadc541ef231a359ee580f2dd0d141f6a92ca927630c9d78acb9c600a8c4f7b868780c5ac617945e4d05b59434d7b397eec6cd8a0f656889cf6be94316300ab7
SSDEEP 24576:i89tv9/7JtDElDEExIecl1erdg0MCiVWhR/adU:i89XJt4HIZ/Gg0P+WhkdU
MD5 SHA1 SHA512 SSDEEP

Submit Download

QQ.exe

Path C:\Users\Admin\AppData\Local\Temp\QQ.exe
Size 377KB
SHA256 bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
MD5 3d6e7db5800f1dadb016cbf989749e3c
SHA1 7c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA512 a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YoL7:HclcceBKlKwAg0Mja/UafOVwbhR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1268-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1268-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1268-29-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1268-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1268-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2128-42-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2128-50-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2128-82-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3316-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3316-10-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3316-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3316-4-0x0000000010000000-0x00000000101B6000-memory.dmp

Download