gh0strat | 91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37

General

Target

91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe
Size

2.2MB
MD5

f0fd7a51108f676605df2ed1c1d48298
SHA1

bd0b03f0d3a73acef70e937c84486df436522d97
SHA256

91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37
SHA512

cdd87926d89424d02229e2072ab9bd6093035a898702b0a562ec3c4ec46bd602a4773da3c07748c430803583a4a65e1c8cff0154c334c319f90e8507be1b25e2
SSDEEP

24576:q09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+YzV/ArT3sXlMrf:q09XJt4HIN2H2tFvduySOz1ArDrf

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 9 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral1/memory/2956-9-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2956-8-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2684-18-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2956-22-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2808-29-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2808-37-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2808-41-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2808-75-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2684-76-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 9 IoCs

resource	yara_rule
behavioral1/memory/2956-9-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2956-8-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2684-18-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2956-22-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2808-29-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2808-37-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2808-41-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2808-75-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2684-76-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 4 IoCs

pid	Process
2956	RVN.exe
2684	TXPlatforn.exe
2808	TXPlatforn.exe
2744	HD_91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe

Loads dropped DLL 4 IoCs

pid	Process
2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe
2684	TXPlatforn.exe
2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe
2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2956-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2956-9-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2956-8-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2684-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2956-22-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2808-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2808-37-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2808-41-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2808-75-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2684-76-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2640	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2808	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2956	RVN.exe
Token: SeLoadDriverPrivilege	2808	TXPlatforn.exe
Token: 33	2808	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2808	TXPlatforn.exe
Token: 33	2808	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2808	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe
2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2956	2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe	28
PID 2252 wrote to memory of 2956	2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe	28
PID 2252 wrote to memory of 2956	2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe	28
PID 2252 wrote to memory of 2956	2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe	28
PID 2252 wrote to memory of 2956	2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe	28
PID 2252 wrote to memory of 2956	2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe	28
PID 2252 wrote to memory of 2956	2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe	28
PID 2684 wrote to memory of 2808	2684	TXPlatforn.exe	31
PID 2684 wrote to memory of 2808	2684	TXPlatforn.exe	31
PID 2684 wrote to memory of 2808	2684	TXPlatforn.exe	31
PID 2684 wrote to memory of 2808	2684	TXPlatforn.exe	31
PID 2684 wrote to memory of 2808	2684	TXPlatforn.exe	31
PID 2684 wrote to memory of 2808	2684	TXPlatforn.exe	31
PID 2684 wrote to memory of 2808	2684	TXPlatforn.exe	31
PID 2956 wrote to memory of 2556	2956	RVN.exe	30
PID 2956 wrote to memory of 2556	2956	RVN.exe	30
PID 2956 wrote to memory of 2556	2956	RVN.exe	30
PID 2956 wrote to memory of 2556	2956	RVN.exe	30
PID 2252 wrote to memory of 2744	2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe	32
PID 2252 wrote to memory of 2744	2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe	32
PID 2252 wrote to memory of 2744	2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe	32
PID 2252 wrote to memory of 2744	2252	91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe	32
PID 2556 wrote to memory of 2640	2556	cmd.exe	34
PID 2556 wrote to memory of 2640	2556	cmd.exe	34
PID 2556 wrote to memory of 2640	2556	cmd.exe	34
PID 2556 wrote to memory of 2640	2556	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe
"C:\Users\Admin\AppData\Local\Temp\91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\RVN.exe
  C:\Users\Admin\AppData\Local\Temp\\RVN.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      Runs ping.exe
      PID:2640
- C:\Users\Admin\AppData\Local\Temp\HD_91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe
  C:\Users\Admin\AppData\Local\Temp\HD_91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe
  2⤵
  - Executes dropped EXE
  PID:2744

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_91275de799427e33ac7d036fb26e261b1a7f6dddf88c07d53fffe82daa1cad37.exe

Filesize
824KB

MD5
adf26f959b3a76fd695cb4160f4a9732

SHA1
7c3b5756888e8d8364c7a006ddd7f8e22a811ad8

SHA256
23fa621b58239705c7fe60a2d098449c7450a1e3021c11d813e057cc82485ec8

SHA512
7869b596a6a8b770bf00bd9ae832571bc59f8676a724b77928a8ba520a1352e588932b80670fea75cbb5d90e1d99d72b988c8f8a5fe8a3026d13b2573855e1e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.4MB

MD5
b8280cc0c4344e4989f37e5eb38b4a83

SHA1
fd1ce10b4739b5ff8661082c267d5e2cbb143e96

SHA256
f18eb68cb9cede84611e2561b696b61419cfaee5490cb259d190681029cc53dd

SHA512
3af370ac0c83968db0ccaad64ff90d4e15a7005ec58686517ae3541c9f61d0f1f643a5eb22236638f943f4b01d8f309676f015cc1332901a1f77cfbe1b80495d

Download Submit
\Users\Admin\AppData\Local\Temp\RVN.exe

Filesize
377KB

MD5
80ade1893dec9cab7f2e63538a464fcc

SHA1
c06614da33a65eddb506db00a124a3fc3f5be02e

SHA256
57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

SHA512
fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

Download Submit
memory/2684-76-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2684-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2808-41-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2808-29-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2808-37-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2808-75-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2956-22-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2956-8-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2956-9-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2956-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads