Malware Analysis Report

2024-09-22 15:11

Sample ID 240602-mlfmnabc52
Target bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c
SHA256 bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c
Tags
gh0strat purplefox persistence rat rootkit trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c

Threat Level: Known bad

The file bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox persistence rat rootkit trojan

Detect PurpleFox Rootkit

Gh0strat

PurpleFox

Gh0st RAT payload

Sets service image path in registry

Drops file in Drivers directory

Loads dropped DLL

Executes dropped EXE

Deletes itself

Drops file in System32 directory

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Runs ping.exe

Modifies data under HKEY_USERS

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-02 10:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 10:32

Reported

2024-06-02 10:35

Platform

win7-20240221-en

Max time kernel

128s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\systeam.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\systeam.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\systeam.exe N/A
N/A N/A C:\Windows\SysWOW64\systeam.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\systeam.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\systeam.exe C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe N/A
File opened for modification C:\Windows\SysWOW64\systeam.exe C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\SysWOW64\systeam.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\SysWOW64\systeam.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\SysWOW64\systeam.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SysWOW64\systeam.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\systeam.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\systeam.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\systeam.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\systeam.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\systeam.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\systeam.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2188 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe C:\Windows\SysWOW64\cmd.exe
PID 2252 wrote to memory of 2884 N/A C:\Windows\SysWOW64\systeam.exe C:\Windows\SysWOW64\systeam.exe
PID 2252 wrote to memory of 2884 N/A C:\Windows\SysWOW64\systeam.exe C:\Windows\SysWOW64\systeam.exe
PID 2252 wrote to memory of 2884 N/A C:\Windows\SysWOW64\systeam.exe C:\Windows\SysWOW64\systeam.exe
PID 2252 wrote to memory of 2884 N/A C:\Windows\SysWOW64\systeam.exe C:\Windows\SysWOW64\systeam.exe
PID 2824 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2824 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2824 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2824 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe

"C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe"

C:\Windows\SysWOW64\systeam.exe

C:\Windows\SysWOW64\systeam.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\BEE726~1.EXE > nul

C:\Windows\SysWOW64\systeam.exe

C:\Windows\SysWOW64\systeam.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 frp-oil.top udp
CN 113.56.218.150:15267 frp-oil.top tcp
CN 113.56.218.150:15267 frp-oil.top tcp
CN 113.56.218.150:15267 frp-oil.top tcp
CN 113.56.218.150:15267 frp-oil.top tcp
CN 113.56.218.150:15267 frp-oil.top tcp
CN 113.56.218.150:15267 frp-oil.top tcp

Files

memory/2188-0-0x0000000010000000-0x000000001019F000-memory.dmp

C:\Windows\SysWOW64\systeam.exe

MD5 761d1e733e792daf72c65bc1e5316045
SHA1 c67b708d4112ad1245fb41e65cf64a0af0e5cb58
SHA256 bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c
SHA512 6288722441d26d52ad478d07d1a6e408dffd08ec1424d421e14ca040d5f02090ed2daa4de07f1c5d66d5cbe80a63e43bdb4c1e0329925c18094f8d10839e68cf

memory/2884-19-0x0000000010000000-0x000000001019F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 10:32

Reported

2024-06-02 10:35

Platform

win10v2004-20240426-en

Max time kernel

146s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Windows\SysWOW64\systeam.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Windows\SysWOW64\systeam.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\systeam.exe N/A
N/A N/A C:\Windows\SysWOW64\systeam.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\systeam.exe C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe N/A
File opened for modification C:\Windows\SysWOW64\systeam.exe C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\SysWOW64\systeam.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SysWOW64\systeam.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\SysWOW64\systeam.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\systeam.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\systeam.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\systeam.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\systeam.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\systeam.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\systeam.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe

"C:\Users\Admin\AppData\Local\Temp\bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c.exe"

C:\Windows\SysWOW64\systeam.exe

C:\Windows\SysWOW64\systeam.exe -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\BEE726~1.EXE > nul

C:\Windows\SysWOW64\systeam.exe

C:\Windows\SysWOW64\systeam.exe -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 frp-oil.top udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
CN 113.56.218.150:15267 frp-oil.top tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
CN 113.56.218.150:15267 frp-oil.top tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
CN 113.56.218.150:15267 frp-oil.top tcp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
CN 113.56.218.150:15267 frp-oil.top tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
CN 113.56.218.150:15267 frp-oil.top tcp
CN 113.56.218.150:15267 frp-oil.top tcp
CN 113.56.218.150:15267 frp-oil.top tcp

Files

memory/3936-0-0x0000000010000000-0x000000001019F000-memory.dmp

C:\Windows\SysWOW64\systeam.exe

MD5 761d1e733e792daf72c65bc1e5316045
SHA1 c67b708d4112ad1245fb41e65cf64a0af0e5cb58
SHA256 bee726ee33b3a8222ed67c991c5de535f8e90978ba253305c7d88e11fb05141c
SHA512 6288722441d26d52ad478d07d1a6e408dffd08ec1424d421e14ca040d5f02090ed2daa4de07f1c5d66d5cbe80a63e43bdb4c1e0329925c18094f8d10839e68cf

memory/2360-11-0x0000000010000000-0x000000001019F000-memory.dmp

memory/1004-18-0x0000000010000000-0x000000001019F000-memory.dmp