gh0strat | bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe
Size 1.7MB
Sample240625-pd59fssbpq
SHA256 bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf
MD5 6c21f18730cc88365129fb43a86e04b4
SHA1 2e0355b18028e9268417e99bb856c885bfc850f1
SHA512 f0ae2b2a10e5e5474dd37708a6321376de2f9e638683face5732c469e3c5d51be56575702b8b12e93e0270e9932a25c56474532dff8ac23dce99ea1fa762a73f
SSDEEP 49152:D09XJt4HIN2H2tFvduySczqDmn2ANUA8w8BRBzE:QZJt4HINy2LkkqDmn2zgu/4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 11 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/940-6-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/940-10-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/940-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3636-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3636-20-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2272-28-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3636-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2272-29-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3636-30-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2272-32-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2272-35-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 11 IoCs

resource	yara_rule
behavioral2/memory/940-6-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/940-10-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/940-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3636-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3636-20-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2272-28-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3636-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2272-29-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3636-30-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2272-32-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2272-35-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 4 IoCs

pid	Process
940	RVN.exe
3636	TXPlatforn.exe
2108	HD_bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe
2272	TXPlatforn.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/940-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/940-10-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/940-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/940-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3636-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3636-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3636-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2272-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3636-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2272-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3636-30-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2272-32-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2272-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4904	2108	WerFault.exe	84

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4784	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4968	bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe
4968	bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2272	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	940	RVN.exe
Token: SeLoadDriverPrivilege	2272	TXPlatforn.exe
Token: 33	2272	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2272	TXPlatforn.exe
Token: 33	2272	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2272	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4968	bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe
4968	bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 940	4968	bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe	81
PID 4968 wrote to memory of 940	4968	bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe	81
PID 4968 wrote to memory of 940	4968	bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe	81
PID 940 wrote to memory of 2240	940	RVN.exe	83
PID 940 wrote to memory of 2240	940	RVN.exe	83
PID 940 wrote to memory of 2240	940	RVN.exe	83
PID 4968 wrote to memory of 2108	4968	bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe	84
PID 4968 wrote to memory of 2108	4968	bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe	84
PID 4968 wrote to memory of 2108	4968	bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe	84
PID 3636 wrote to memory of 2272	3636	TXPlatforn.exe	85
PID 3636 wrote to memory of 2272	3636	TXPlatforn.exe	85
PID 3636 wrote to memory of 2272	3636	TXPlatforn.exe	85
PID 2240 wrote to memory of 4784	2240	cmd.exe	87
PID 2240 wrote to memory of 4784	2240	cmd.exe	87
PID 2240 wrote to memory of 4784	2240	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe
"C:\Users\Admin\AppData\Local\Temp\bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\RVN.exe
  C:\Users\Admin\AppData\Local\Temp\\RVN.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4784
- C:\Users\Admin\AppData\Local\Temp\HD_bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe
  C:\Users\Admin\AppData\Local\Temp\HD_bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 540
    3⤵
    - Program crash
    PID:4904

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2108 -ip 2108
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.4MB
SHA256 62bf1ec63cb9ec825d01954bda1f7975b6168d3820150683d85a5803a1a6118b
MD5 d04b5d05490e359b8a1859c4205f876f
SHA1 1e6c81d37c7f5ae89199f13a6bb2a9279cff99de
SHA512 6f137d4735c5ec4345409d00d99ff5cb9db6440f75c017633df3ac0d9bf6e04ea9646a44cc276a67a0d92ea2bf9d974de0408a3c93d5c2a6b1b901389afbc388
SSDEEP 24576:D09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+yzTG1Dfun2b:D09XJt4HIN2H2tFvduySczqDmn2b
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD_bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_bfaac704f43518555579b4ccf22ebb8b957d654944e445e7f75a3806a19d2aaf.exe
Size 394KB
SHA256 39e10730de08b822cd99f4d89bc1b90766d27c6534da1908c90ce535756aaf95
MD5 090f059cb956d806be235076088c0e6c
SHA1 d0264a78358a9646cf8e9cee24485b0520561897
SHA512 f1e2f6e567b9cf287c8c903369a55262be5b74ba4c43a60444960492fc7d0cd483a59e716bedfef225b5343b32962829c26c6564ca0bf2f8b3a59d5662f172c8
SSDEEP 12288:LVmwGZiUcsq015PvLKJ874Za2SsW74Za2Ss8vjo:LwqUcsq85n+8B2yB2gvE
MD5 SHA1 SHA512 SSDEEP

Submit Download

RVN.exe

Path C:\Users\Admin\AppData\Local\Temp\RVN.exe
Size 377KB
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
SSDEEP 6144:BEo7J1ixs4uVKE9rFEAHKThrBSq2hAzSM5mDo9lSJULHZqExlD2E1LxhJVwIe0Dy:Wo2HQVWAHkFSq2hAWJYlMUtrxlyuJVRq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/940-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/940-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/940-10-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/940-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2272-28-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2272-29-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2272-32-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2272-35-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3636-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3636-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3636-20-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3636-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3636-30-0x0000000010000000-0x00000000101B6000-memory.dmp

Download