gh0strat | 1c7a33e71a728b447acc44d5aef93b45a3328b94913caaa2f577e90d82dfc974

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1c7a33e71a728b447acc44d5aef93b45a3328b94913caaa2f577e90d82dfc974.exe
Size 1.8MB
Sample240616-fxhstsvdrp
SHA256 1c7a33e71a728b447acc44d5aef93b45a3328b94913caaa2f577e90d82dfc974
MD5 bb82ecaf07c2509265e8a167ebc375a8
SHA1 8771345c76b6b3dcbb42a50ae622b52bd4d3b939
SHA512 548055b270d49783ececc53a711764cb4f325d6958548a25479e5fdc19dbfe9e3ee160911e465a48e9a1bd5beabad45aa8c54735f94b072c9ad1c058878673f1
SSDEEP 24576:KUgRNipWfy3ljqRv2hKWhGo+URTwRu6F4JyXVo/7G3ly4j8RPoqX3:KUgRNV29ncWUoM+J26/qrkl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 7 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/1288-2-0x0000000000400000-0x0000000000770DA3-memory.dmp	purplefox_rootkit
behavioral2/memory/1288-3-0x0000000010000000-0x00000000101A0000-memory.dmp	purplefox_rootkit
behavioral2/memory/4252-15-0x0000000000400000-0x0000000000770DA3-memory.dmp	purplefox_rootkit
behavioral2/memory/1288-22-0x0000000000400000-0x0000000000770DA3-memory.dmp	purplefox_rootkit
behavioral2/memory/4252-26-0x0000000000400000-0x0000000000770DA3-memory.dmp	purplefox_rootkit
behavioral2/memory/1100-27-0x0000000000400000-0x0000000000770DA3-memory.dmp	purplefox_rootkit
behavioral2/memory/1100-28-0x0000000010000000-0x00000000101A0000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/1288-2-0x0000000000400000-0x0000000000770DA3-memory.dmp	family_gh0strat
behavioral2/memory/1288-3-0x0000000010000000-0x00000000101A0000-memory.dmp	family_gh0strat
behavioral2/memory/4252-15-0x0000000000400000-0x0000000000770DA3-memory.dmp	family_gh0strat
behavioral2/memory/1288-22-0x0000000000400000-0x0000000000770DA3-memory.dmp	family_gh0strat
behavioral2/memory/4252-26-0x0000000000400000-0x0000000000770DA3-memory.dmp	family_gh0strat
behavioral2/memory/1100-27-0x0000000000400000-0x0000000000770DA3-memory.dmp	family_gh0strat
behavioral2/memory/1100-28-0x0000000010000000-0x00000000101A0000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Executes dropped EXE 2 IoCs

pid	Process
4252	SkcWsk.exe
1100	SkcWsk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SkcWsk.exe	1c7a33e71a728b447acc44d5aef93b45a3328b94913caaa2f577e90d82dfc974.exe
File opened for modification	C:\Windows\SysWOW64\SkcWsk.exe	1c7a33e71a728b447acc44d5aef93b45a3328b94913caaa2f577e90d82dfc974.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2696	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1288	1c7a33e71a728b447acc44d5aef93b45a3328b94913caaa2f577e90d82dfc974.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2784	1288	1c7a33e71a728b447acc44d5aef93b45a3328b94913caaa2f577e90d82dfc974.exe	91
PID 1288 wrote to memory of 2784	1288	1c7a33e71a728b447acc44d5aef93b45a3328b94913caaa2f577e90d82dfc974.exe	91
PID 1288 wrote to memory of 2784	1288	1c7a33e71a728b447acc44d5aef93b45a3328b94913caaa2f577e90d82dfc974.exe	91
PID 4252 wrote to memory of 1100	4252	SkcWsk.exe	92
PID 4252 wrote to memory of 1100	4252	SkcWsk.exe	92
PID 4252 wrote to memory of 1100	4252	SkcWsk.exe	92
PID 2784 wrote to memory of 2696	2784	cmd.exe	94
PID 2784 wrote to memory of 2696	2784	cmd.exe	94
PID 2784 wrote to memory of 2696	2784	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\1c7a33e71a728b447acc44d5aef93b45a3328b94913caaa2f577e90d82dfc974.exe
"C:\Users\Admin\AppData\Local\Temp\1c7a33e71a728b447acc44d5aef93b45a3328b94913caaa2f577e90d82dfc974.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\1C7A33~1.EXE > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2696

C:\Windows\SysWOW64\SkcWsk.exe
C:\Windows\SysWOW64\SkcWsk.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SysWOW64\SkcWsk.exe
  C:\Windows\SysWOW64\SkcWsk.exe -acsi
  2⤵
  - Executes dropped EXE
  PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4120,i,11751898164297348119,13021661521765644467,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:8
1⤵
PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SkcWsk.exe

Path C:\Windows\SysWOW64\SkcWsk.exe
Size 1.8MB
SHA256 1c7a33e71a728b447acc44d5aef93b45a3328b94913caaa2f577e90d82dfc974
MD5 bb82ecaf07c2509265e8a167ebc375a8
SHA1 8771345c76b6b3dcbb42a50ae622b52bd4d3b939
SHA512 548055b270d49783ececc53a711764cb4f325d6958548a25479e5fdc19dbfe9e3ee160911e465a48e9a1bd5beabad45aa8c54735f94b072c9ad1c058878673f1
SSDEEP 24576:KUgRNipWfy3ljqRv2hKWhGo+URTwRu6F4JyXVo/7G3ly4j8RPoqX3:KUgRNV29ncWUoM+J26/qrkl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1100-24-0x0000000000400000-0x0000000000770DA3-memory.dmp

Download

memory/1100-28-0x0000000010000000-0x00000000101A0000-memory.dmp

Download

memory/1100-27-0x0000000000400000-0x0000000000770DA3-memory.dmp

Download

memory/1288-1-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/1288-2-0x0000000000400000-0x0000000000770DA3-memory.dmp

Download

memory/1288-3-0x0000000010000000-0x00000000101A0000-memory.dmp

Download

memory/1288-0-0x0000000000400000-0x0000000000770DA3-memory.dmp

Download

memory/1288-22-0x0000000000400000-0x0000000000770DA3-memory.dmp

Download

memory/4252-15-0x0000000000400000-0x0000000000770DA3-memory.dmp

Download

memory/4252-26-0x0000000000400000-0x0000000000770DA3-memory.dmp

Download

memory/4252-14-0x0000000000400000-0x0000000000770DA3-memory.dmp

Download

memory/4252-13-0x0000000000400000-0x0000000000770DA3-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads