gh0strat | f10eb3e1cd0d300c99be2a0ab408028b5ec43cf199994e726e932ef848b9d232

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

监控记录女子被男子拖进巷子强奸杀害视频.exe
Size

2.6MB
MD5

624f003dac0831d062d75c5fcd83cf0b
SHA1

40019566841bd1c70eeaafddd50319267bdd31dd
SHA256

d12aa8d3f49c9e7cff372b8111bf7dcea27be046b2c7328098a5159fb97d840d
SHA512

0081a9ba52dab04c5c31482d752033d30d11cab1307ccf1d40410d67521b6fb910e0fca06a443935494d1ee99335a95c3c2f7939ea278b29d18c17cdce918ad6
SSDEEP

49152:t1vqjdPQwZwViOoOMV+ZsZlRt8DVbP1xgp0FnKyZCbmGpVTT3:t1vqjlALilRu7vg6vW3

Score

10^/10

gh0strat purplefox discovery rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/1300-8-0x0000000010000000-0x0000000010199000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/1300-8-0x0000000010000000-0x0000000010199000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Executes dropped EXE 1 IoCs

pid	Process
1300	xiaoqip.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\xq\xiaoqip.exe	监控记录女子被男子拖进巷子强奸杀害视频.exe
File created	C:\Windows\SysWOW64\xq\xiaoqip.exe	监控记录女子被男子拖进巷子强奸杀害视频.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	监控记录女子被男子拖进巷子强奸杀害视频.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xiaoqip.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1360	监控记录女子被男子拖进巷子强奸杀害视频.exe
1360	监控记录女子被男子拖进巷子强奸杀害视频.exe
1300	xiaoqip.exe
1300	xiaoqip.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1300	xiaoqip.exe
1300	xiaoqip.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 1300	1360	监控记录女子被男子拖进巷子强奸杀害视频.exe	85
PID 1360 wrote to memory of 1300	1360	监控记录女子被男子拖进巷子强奸杀害视频.exe	85
PID 1360 wrote to memory of 1300	1360	监控记录女子被男子拖进巷子强奸杀害视频.exe	85

C:\Users\Admin\AppData\Local\Temp\监控记录女子被男子拖进巷子强奸杀害视频.exe
"C:\Users\Admin\AppData\Local\Temp\监控记录女子被男子拖进巷子强奸杀害视频.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\xq\xiaoqip.exe
  "C:\Windows\SysWOW64\xq\xiaoqip.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xq\xiaoqip.exe

Filesize
3.3MB

MD5
c64776dbebb5f079799a61980ed1f8a0

SHA1
8b8d62442484a046d74e31a05c105230b63f708d

SHA256
1bc44bd8c21b1ca4668664984e9676ebfb7f7442c353091a893ef22a23979c94

SHA512
cd5787a2b83bb6ba99353e79171b1b4da6ddeb5d3214cb5192b90b477e6704abe2f8cc212ecbbee605cf1034c42b83ff31b700a36563ed8d3a1c29b6c93af9d3

Download Submit
memory/1300-8-0x0000000010000000-0x0000000010199000-memory.dmp

Filesize
1.6MB

Download