Malware Analysis Report

2024-09-22 14:54

Sample ID 240618-lmk34axgnc
Target 94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c
SHA256 94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c
Tags
gh0strat purplefox persistence rat rootkit trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c

Threat Level: Known bad

The file 94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c was found to be: Known bad.

Malicious Activity Summary

gh0strat purplefox persistence rat rootkit trojan

Detect PurpleFox Rootkit

Gh0st RAT payload

PurpleFox

Gh0strat

Drops file in Drivers directory

Sets service image path in registry

Deletes itself

Executes dropped EXE

Loads dropped DLL

Drops file in Program Files directory

Unsigned PE

Suspicious use of WriteProcessMemory

Runs ping.exe

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-18 09:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 09:39

Reported

2024-06-18 09:41

Platform

win7-20240611-en

Max time kernel

145s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Program Files (x86)\Google\Skcsk.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Program Files (x86)\Google\Skcsk.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Google\Skcsk.exe N/A
N/A N/A C:\Program Files (x86)\Google\Skcsk.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Google\Skcsk.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\Skcsk.exe C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe N/A
File opened for modification C:\Program Files (x86)\Google\Skcsk.exe C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Google\Skcsk.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Google\Skcsk.exe N/A
Token: 33 N/A C:\Program Files (x86)\Google\Skcsk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Google\Skcsk.exe N/A
Token: 33 N/A C:\Program Files (x86)\Google\Skcsk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Google\Skcsk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2916 wrote to memory of 2652 N/A C:\Program Files (x86)\Google\Skcsk.exe C:\Program Files (x86)\Google\Skcsk.exe
PID 2916 wrote to memory of 2652 N/A C:\Program Files (x86)\Google\Skcsk.exe C:\Program Files (x86)\Google\Skcsk.exe
PID 2916 wrote to memory of 2652 N/A C:\Program Files (x86)\Google\Skcsk.exe C:\Program Files (x86)\Google\Skcsk.exe
PID 2916 wrote to memory of 2652 N/A C:\Program Files (x86)\Google\Skcsk.exe C:\Program Files (x86)\Google\Skcsk.exe
PID 2124 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe C:\Windows\SysWOW64\cmd.exe
PID 2044 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2044 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2044 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2044 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe

"C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe"

C:\Program Files (x86)\Google\Skcsk.exe

"C:\Program Files (x86)\Google\Skcsk.exe" -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\945371~1.EXE > nul

C:\Program Files (x86)\Google\Skcsk.exe

"C:\Program Files (x86)\Google\Skcsk.exe" -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

Network

Country Destination Domain Proto
CN 47.94.123.29:7771 tcp
CN 47.94.123.29:7771 tcp
CN 47.94.123.29:7771 tcp
CN 47.94.123.29:7771 tcp
CN 47.94.123.29:7771 tcp
CN 47.94.123.29:7771 tcp
CN 47.94.123.29:7771 tcp

Files

memory/2124-0-0x0000000010000000-0x000000001019F000-memory.dmp

C:\Program Files (x86)\Google\Skcsk.exe

MD5 4e2fe8d8ace83fc0f7d943e412e0a25f
SHA1 9dba5ae7134880abd25eae481e1fd3f2e3b8bcbd
SHA256 94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c
SHA512 8c2097d4aff23adc23a30934e39c7b69cd271b48102d04e6211e8bfb1571bfbaaba3490c27e9dfdee6b669d7080cdc08409b95979089ba271e2be6889b33e9bd

memory/2652-18-0x0000000010000000-0x000000001019F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 09:39

Reported

2024-06-18 09:41

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe"

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

PurpleFox

rootkit trojan purplefox

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\QAssist.sys C:\Program Files (x86)\Google\Skcsk.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" C:\Program Files (x86)\Google\Skcsk.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Google\Skcsk.exe N/A
N/A N/A C:\Program Files (x86)\Google\Skcsk.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Google\Skcsk.exe C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe N/A
File opened for modification C:\Program Files (x86)\Google\Skcsk.exe C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Google\Skcsk.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Google\Skcsk.exe N/A
Token: 33 N/A C:\Program Files (x86)\Google\Skcsk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Google\Skcsk.exe N/A
Token: 33 N/A C:\Program Files (x86)\Google\Skcsk.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Google\Skcsk.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe

"C:\Users\Admin\AppData\Local\Temp\94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c.exe"

C:\Program Files (x86)\Google\Skcsk.exe

"C:\Program Files (x86)\Google\Skcsk.exe" -auto

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\945371~1.EXE > nul

C:\Program Files (x86)\Google\Skcsk.exe

"C:\Program Files (x86)\Google\Skcsk.exe" -acsi

C:\Windows\SysWOW64\PING.EXE

ping -n 2 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
CN 47.94.123.29:7771 tcp
CN 47.94.123.29:7771 tcp
CN 47.94.123.29:7771 tcp
CN 47.94.123.29:7771 tcp
CN 47.94.123.29:7771 tcp
CN 47.94.123.29:7771 tcp
CN 47.94.123.29:7771 tcp

Files

memory/372-0-0x0000000010000000-0x000000001019F000-memory.dmp

C:\Program Files (x86)\Google\Skcsk.exe

MD5 4e2fe8d8ace83fc0f7d943e412e0a25f
SHA1 9dba5ae7134880abd25eae481e1fd3f2e3b8bcbd
SHA256 94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c
SHA512 8c2097d4aff23adc23a30934e39c7b69cd271b48102d04e6211e8bfb1571bfbaaba3490c27e9dfdee6b669d7080cdc08409b95979089ba271e2be6889b33e9bd

memory/3496-10-0x0000000010000000-0x000000001019F000-memory.dmp

memory/232-17-0x0000000010000000-0x000000001019F000-memory.dmp