gh0strat | ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75

General

Target

ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe
Size

6.2MB
MD5

f1b502e7e2c6e4288984bdbffc1fb8b9
SHA1

a5be8f99c62bf1b41ad971d538254a78bd64dc1b
SHA256

ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75
SHA512

07a6b84592586dcbd98e74cf6a5f55c9996857f2f573d011ac9d5339c719734555cbff7226740ac2f3a7d08bb873436b0da4fed2137c789382378519d0d2fb31
SSDEEP

196608:Wy2LkJnlEjOu1WcTwpWkYybdBRqI41TJSHQXt4:3nlMYNpvb1n41IHT

Score

10^/10

gh0strat purplefox evasion persistence rat rootkit themida trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 6 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral1/memory/1932-18-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/1932-17-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/1932-38-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2724-51-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2724-48-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2724-53-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 6 IoCs

resource	yara_rule
behavioral1/memory/1932-18-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/1932-17-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/1932-38-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2724-51-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2724-48-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2724-53-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	HD_ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	HD_ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	HD_ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe

Executes dropped EXE 4 IoCs

pid	Process
1932	RVN.exe
2688	HD_ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe
2660	TXPlatforn.exe
2724	TXPlatforn.exe

Loads dropped DLL 5 IoCs

pid	Process
1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe
1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe
1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe
2160	Process not Found
2660	TXPlatforn.exe

Themida packer 11 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0008000000015cf3-8.dat	themida
behavioral1/memory/2688-25-0x0000000000F60000-0x0000000001E32000-memory.dmp	themida
behavioral1/memory/2688-27-0x0000000000F60000-0x0000000001E32000-memory.dmp	themida
behavioral1/memory/2688-40-0x0000000000F60000-0x0000000001E32000-memory.dmp	themida
behavioral1/memory/2688-26-0x0000000000F60000-0x0000000001E32000-memory.dmp	themida
behavioral1/memory/2688-37-0x0000000000F60000-0x0000000001E32000-memory.dmp	themida
behavioral1/memory/2688-24-0x0000000000F60000-0x0000000001E32000-memory.dmp	themida
behavioral1/memory/2688-36-0x0000000000F60000-0x0000000001E32000-memory.dmp	themida
behavioral1/memory/2688-30-0x0000000000F60000-0x0000000001E32000-memory.dmp	themida
behavioral1/memory/2688-29-0x0000000000F60000-0x0000000001E32000-memory.dmp	themida
behavioral1/memory/2688-28-0x0000000000F60000-0x0000000001E32000-memory.dmp	themida

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1932-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/1932-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/1932-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/1932-38-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2724-51-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2724-48-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2724-53-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	HD_ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2688	HD_ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2504	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2724	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1932	RVN.exe
Token: SeLoadDriverPrivilege	2724	TXPlatforn.exe
Token: 33	2724	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2724	TXPlatforn.exe
Token: 33	2724	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2724	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1932	1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe	28
PID 1600 wrote to memory of 1932	1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe	28
PID 1600 wrote to memory of 1932	1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe	28
PID 1600 wrote to memory of 1932	1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe	28
PID 1600 wrote to memory of 1932	1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe	28
PID 1600 wrote to memory of 1932	1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe	28
PID 1600 wrote to memory of 1932	1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe	28
PID 1600 wrote to memory of 2688	1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe	29
PID 1600 wrote to memory of 2688	1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe	29
PID 1600 wrote to memory of 2688	1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe	29
PID 1600 wrote to memory of 2688	1600	ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe	29
PID 1932 wrote to memory of 2976	1932	RVN.exe	32
PID 1932 wrote to memory of 2976	1932	RVN.exe	32
PID 1932 wrote to memory of 2976	1932	RVN.exe	32
PID 1932 wrote to memory of 2976	1932	RVN.exe	32
PID 2660 wrote to memory of 2724	2660	TXPlatforn.exe	34
PID 2660 wrote to memory of 2724	2660	TXPlatforn.exe	34
PID 2660 wrote to memory of 2724	2660	TXPlatforn.exe	34
PID 2660 wrote to memory of 2724	2660	TXPlatforn.exe	34
PID 2660 wrote to memory of 2724	2660	TXPlatforn.exe	34
PID 2660 wrote to memory of 2724	2660	TXPlatforn.exe	34
PID 2660 wrote to memory of 2724	2660	TXPlatforn.exe	34
PID 2976 wrote to memory of 2504	2976	cmd.exe	35
PID 2976 wrote to memory of 2504	2976	cmd.exe	35
PID 2976 wrote to memory of 2504	2976	cmd.exe	35
PID 2976 wrote to memory of 2504	2976	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe
"C:\Users\Admin\AppData\Local\Temp\ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\RVN.exe
  C:\Users\Admin\AppData\Local\Temp\\RVN.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2504
- C:\Users\Admin\AppData\Local\Temp\HD_ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe
  C:\Users\Admin\AppData\Local\Temp\HD_ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2688

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
740KB

MD5
316b0888ecddb8971d4a771494482120

SHA1
3cf14c0874d83f317a4e79a53fcf012da91de282

SHA256
f779d86bc8cc849a9659f1697f28bda956cbe33ca51115069362c5fc40e203f9

SHA512
92a7a02b09824b9f0bb6aac8b2f20a032ac9af8e3edae8c8522c9ea1d1a830678eb80cc084ddb0d6e05be32db3808cf3b81e3db850cf045317b881233f577752

Download Submit
\Users\Admin\AppData\Local\Temp\HD_ed3b32499054cd44eaa26fcd6b06a4e79b849daf671ea94b22da78f4e9a41d75.exe

Filesize
5.5MB

MD5
0b637be1c825abe58212db2732051afc

SHA1
a9bb3daceee51695ecd020b42f5cedadbe0013be

SHA256
2ce9cb471ba6acbc4c82d257ca4d88c71d06a11ca9a062ff4e4d67ef06ed61ea

SHA512
f2c55489c27092092d0ee96bd2964188ef6e20b35309d216eb63df11a527ea7501137309b27ebfb605f0216c69ad1bfa5dba35859b155c872ec103dca0ac3e8e

Download Submit
\Users\Admin\AppData\Local\Temp\RVN.exe

Filesize
377KB

MD5
80ade1893dec9cab7f2e63538a464fcc

SHA1
c06614da33a65eddb506db00a124a3fc3f5be02e

SHA256
57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

SHA512
fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

Download Submit
memory/1600-23-0x00000000032E0000-0x00000000041B2000-memory.dmp

Filesize
14.8MB

Download
memory/1600-54-0x00000000032E0000-0x00000000041B2000-memory.dmp

Filesize
14.8MB

Download
memory/1932-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1932-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1932-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1932-38-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2688-26-0x0000000000F60000-0x0000000001E32000-memory.dmp

Filesize
14.8MB

Download
memory/2688-40-0x0000000000F60000-0x0000000001E32000-memory.dmp

Filesize
14.8MB

Download
memory/2688-37-0x0000000000F60000-0x0000000001E32000-memory.dmp

Filesize
14.8MB

Download
memory/2688-24-0x0000000000F60000-0x0000000001E32000-memory.dmp

Filesize
14.8MB

Download
memory/2688-36-0x0000000000F60000-0x0000000001E32000-memory.dmp

Filesize
14.8MB

Download
memory/2688-30-0x0000000000F60000-0x0000000001E32000-memory.dmp

Filesize
14.8MB

Download
memory/2688-29-0x0000000000F60000-0x0000000001E32000-memory.dmp

Filesize
14.8MB

Download
memory/2688-28-0x0000000000F60000-0x0000000001E32000-memory.dmp

Filesize
14.8MB

Download
memory/2688-27-0x0000000000F60000-0x0000000001E32000-memory.dmp

Filesize
14.8MB

Download
memory/2688-25-0x0000000000F60000-0x0000000001E32000-memory.dmp

Filesize
14.8MB

Download
memory/2724-51-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2724-48-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2724-53-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads