gh0strat | ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527

General

Target

ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe
Size

1.4MB
MD5

cea39770a027c357a1cbc1bbd02f07d4
SHA1

6dd88736f7e752bd9d5c76c198c73d11d7b6ce84
SHA256

ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527
SHA512

59a8dc888ddad59e11b285b4b0a48e8efb6b758f0558d824251869f9c666d809c706454c69c0cc19da0ec1f0b185222ac6be5f34ae788ad995be3e21a27594ca
SSDEEP

24576:g09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+Du0PNqP/1PPDrR:g09XJt4HIN2H2tFvduySZWZPDrR

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 11 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral1/memory/1996-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/1996-12-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/1996-8-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2444-18-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2816-74-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2816-40-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2816-36-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2816-29-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2816-28-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2816-27-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2444-24-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 11 IoCs

resource	yara_rule
behavioral1/memory/1996-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/1996-12-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/1996-8-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2444-18-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2816-74-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2816-40-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2816-36-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2816-29-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2816-28-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2816-27-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2444-24-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 4 IoCs

pid	Process
1996	RVN.exe
2444	TXPlatforn.exe
2816	TXPlatforn.exe
2696	HD_ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe

Loads dropped DLL 4 IoCs

pid	Process
3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe
2444	TXPlatforn.exe
3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe
3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1996-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/1996-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/1996-12-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/1996-8-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2444-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2816-74-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2816-40-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2816-36-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2816-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2816-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2816-27-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2816-25-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2444-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2600	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2816	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1996	RVN.exe
Token: SeLoadDriverPrivilege	2816	TXPlatforn.exe
Token: 33	2816	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2816	TXPlatforn.exe
Token: 33	2816	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2816	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe
3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1996	3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe	28
PID 3040 wrote to memory of 1996	3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe	28
PID 3040 wrote to memory of 1996	3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe	28
PID 3040 wrote to memory of 1996	3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe	28
PID 3040 wrote to memory of 1996	3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe	28
PID 3040 wrote to memory of 1996	3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe	28
PID 3040 wrote to memory of 1996	3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe	28
PID 1996 wrote to memory of 2072	1996	RVN.exe	30
PID 1996 wrote to memory of 2072	1996	RVN.exe	30
PID 1996 wrote to memory of 2072	1996	RVN.exe	30
PID 1996 wrote to memory of 2072	1996	RVN.exe	30
PID 2444 wrote to memory of 2816	2444	TXPlatforn.exe	31
PID 2444 wrote to memory of 2816	2444	TXPlatforn.exe	31
PID 2444 wrote to memory of 2816	2444	TXPlatforn.exe	31
PID 2444 wrote to memory of 2816	2444	TXPlatforn.exe	31
PID 2444 wrote to memory of 2816	2444	TXPlatforn.exe	31
PID 2444 wrote to memory of 2816	2444	TXPlatforn.exe	31
PID 2444 wrote to memory of 2816	2444	TXPlatforn.exe	31
PID 3040 wrote to memory of 2696	3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe	32
PID 3040 wrote to memory of 2696	3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe	32
PID 3040 wrote to memory of 2696	3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe	32
PID 3040 wrote to memory of 2696	3040	ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe	32
PID 2072 wrote to memory of 2600	2072	cmd.exe	34
PID 2072 wrote to memory of 2600	2072	cmd.exe	34
PID 2072 wrote to memory of 2600	2072	cmd.exe	34
PID 2072 wrote to memory of 2600	2072	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe
"C:\Users\Admin\AppData\Local\Temp\ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\RVN.exe
  C:\Users\Admin\AppData\Local\Temp\\RVN.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2600
- C:\Users\Admin\AppData\Local\Temp\HD_ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe
  C:\Users\Admin\AppData\Local\Temp\HD_ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe
  2⤵
  - Executes dropped EXE
  PID:2696

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.3MB

MD5
34e378b9529a45aeec7891d8d18a4f6f

SHA1
67082036e47f6af6eb9dd480d65945843c07e656

SHA256
7b27feff0a3cec10e6a1c6219832f1ac01f0cfeeecb2214311080accc398edff

SHA512
9cdb0ff1bbe3227929c5ac4d6f1d78981fafdd903fe2a93037addf057c5344cdd5aa001d0269d186fe3e77bfcd474fddaab904914969318c70a8528d4a66b00e

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_ab45059f134fd9d980ef278dc2f79669c12198bc807d02fbeb302cc9ea061527.exe

Filesize
189KB

MD5
768d75ebf14e22087943f118ae9e4d93

SHA1
aa674a1c002e4cc52b9e6ccc932f44a750309cc3

SHA256
b842226070d2007e09efe5d3a9665fda909f2e134a347d99d9825b0c5f89b223

SHA512
a439e2201e1c40fa5470aee5a928178d7f69c872b3ca55f102011e73c164325697b6ae432e7c87d40d907ed0da3c1019d7a4cf0b96282b5b01f59f611af81418

Download Submit
C:\Users\Admin\AppData\Local\Temp\RVN.exe

Filesize
377KB

MD5
80ade1893dec9cab7f2e63538a464fcc

SHA1
c06614da33a65eddb506db00a124a3fc3f5be02e

SHA256
57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

SHA512
fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

Download Submit
memory/1996-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1996-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1996-12-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1996-8-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2444-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2444-24-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2816-40-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2816-36-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2816-29-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2816-28-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2816-27-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2816-25-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2816-74-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads