gh0strat | b523fc3adf6fac18780072fa8f29f764b1e3553bab320cf146a2030bcaae3300

General

Target

2024-10-12_9e3831439e068c6c79d0a3fa5916f53a_icedid.exe
Size

2.4MB
MD5

9e3831439e068c6c79d0a3fa5916f53a
SHA1

fd931c1459001d411917ca47e5d6a3582c512127
SHA256

b523fc3adf6fac18780072fa8f29f764b1e3553bab320cf146a2030bcaae3300
SHA512

37a99bbea42151a70069223ceddabc8c33c00b803a09ecb9d6470f852af4d233c32884ff9a1bcda7f8c6c2f544c7e9b6de695c96bde0ec3cab2fbc4ed149a7b6
SSDEEP

49152:dbofjdxhsELqtudFRxSavMw2YEwxJqpmsbhyN9gxROTMy02Ak/g:dkfjpsaqqnx0w/WpRsfyt/RX

Score

10^/10

gh0strat purplefox discovery rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 19 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/2636-5-0x0000000010000000-0x00000000101A0000-memory.dmp	purplefox_rootkit
behavioral2/memory/4324-15-0x0000000010000000-0x00000000101A0000-memory.dmp	purplefox_rootkit
behavioral2/memory/2636-23-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/4324-26-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/3628-37-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/3628-38-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/3628-39-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/3628-40-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/3628-41-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/3628-42-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/3628-43-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/3628-44-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/3628-45-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/3628-46-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/3628-47-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/3628-48-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/3628-49-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/3628-50-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit
behavioral2/memory/3628-51-0x0000000000400000-0x00000000008D8000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 19 IoCs

resource	yara_rule
behavioral2/memory/2636-5-0x0000000010000000-0x00000000101A0000-memory.dmp	family_gh0strat
behavioral2/memory/4324-15-0x0000000010000000-0x00000000101A0000-memory.dmp	family_gh0strat
behavioral2/memory/2636-23-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/4324-26-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/3628-37-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/3628-38-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/3628-39-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/3628-40-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/3628-41-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/3628-42-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/3628-43-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/3628-44-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/3628-45-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/3628-46-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/3628-47-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/3628-48-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/3628-49-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/3628-50-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat
behavioral2/memory/3628-51-0x0000000000400000-0x00000000008D8000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Executes dropped EXE 3 IoCs

pid	Process
2636	Tempbwklejglkja.exe
4324	NfvWne.exe
3628	NfvWne.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Delete00.bat	2024-10-12_9e3831439e068c6c79d0a3fa5916f53a_icedid.exe
File created	C:\Windows\SysWOW64\NfvWne.exe	Tempbwklejglkja.exe
File opened for modification	C:\Windows\SysWOW64\NfvWne.exe	Tempbwklejglkja.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
2636	Tempbwklejglkja.exe
2636	Tempbwklejglkja.exe
4324	NfvWne.exe
3628	NfvWne.exe
3628	NfvWne.exe
3628	NfvWne.exe
3628	NfvWne.exe
3628	NfvWne.exe
3628	NfvWne.exe
3628	NfvWne.exe
3628	NfvWne.exe
3628	NfvWne.exe
3628	NfvWne.exe
3628	NfvWne.exe
3628	NfvWne.exe
3628	NfvWne.exe
3628	NfvWne.exe
3628	NfvWne.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NfvWne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NfvWne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-12_9e3831439e068c6c79d0a3fa5916f53a_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tempbwklejglkja.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3536	cmd.exe
5084	PING.EXE
2840	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5084	PING.EXE
2840	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2636	Tempbwklejglkja.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4752	2024-10-12_9e3831439e068c6c79d0a3fa5916f53a_icedid.exe
4752	2024-10-12_9e3831439e068c6c79d0a3fa5916f53a_icedid.exe
2636	Tempbwklejglkja.exe
4324	NfvWne.exe
3628	NfvWne.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 2636	4752	2024-10-12_9e3831439e068c6c79d0a3fa5916f53a_icedid.exe	86
PID 4752 wrote to memory of 2636	4752	2024-10-12_9e3831439e068c6c79d0a3fa5916f53a_icedid.exe	86
PID 4752 wrote to memory of 2636	4752	2024-10-12_9e3831439e068c6c79d0a3fa5916f53a_icedid.exe	86
PID 2636 wrote to memory of 3536	2636	Tempbwklejglkja.exe	88
PID 2636 wrote to memory of 3536	2636	Tempbwklejglkja.exe	88
PID 2636 wrote to memory of 3536	2636	Tempbwklejglkja.exe	88
PID 4324 wrote to memory of 3628	4324	NfvWne.exe	90
PID 4324 wrote to memory of 3628	4324	NfvWne.exe	90
PID 4324 wrote to memory of 3628	4324	NfvWne.exe	90
PID 3536 wrote to memory of 5084	3536	cmd.exe	91
PID 3536 wrote to memory of 5084	3536	cmd.exe	91
PID 3536 wrote to memory of 5084	3536	cmd.exe	91
PID 4752 wrote to memory of 4232	4752	2024-10-12_9e3831439e068c6c79d0a3fa5916f53a_icedid.exe	92
PID 4752 wrote to memory of 4232	4752	2024-10-12_9e3831439e068c6c79d0a3fa5916f53a_icedid.exe	92
PID 4752 wrote to memory of 4232	4752	2024-10-12_9e3831439e068c6c79d0a3fa5916f53a_icedid.exe	92
PID 4232 wrote to memory of 2840	4232	cmd.exe	94
PID 4232 wrote to memory of 2840	4232	cmd.exe	94
PID 4232 wrote to memory of 2840	4232	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\2024-10-12_9e3831439e068c6c79d0a3fa5916f53a_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-12_9e3831439e068c6c79d0a3fa5916f53a_icedid.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Users\Admin\AppData\Local\Tempbwklejglkja.exe
  C:\Users\Admin\AppData\Local\Tempbwklejglkja.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\TEMPBW~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\\Delete00.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2840

C:\Windows\SysWOW64\NfvWne.exe
C:\Windows\SysWOW64\NfvWne.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\NfvWne.exe
  C:\Windows\SysWOW64\NfvWne.exe -acsi
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Tempbwklejglkja.exe

Filesize
1.6MB

MD5
9a7267f57849570cbaabf7c959a329cb

SHA1
6c6eca986ff99077d4b1e77c3735c0da36567c6c

SHA256
bdcb467fb9612e48ba975d867c3a951960fd3f92786c8a54b71558c252eb3054

SHA512
97ec5fd2a0c20077eebeaca30886814d169e361d7213a76069e94cbaea28f6058448c4ec6ca6b2f52d6c4ee90e97ffc02d307243d7899501a4df04b8b06099f3

Download Submit
C:\Windows\SysWOW64\Delete00.bat

Filesize
151B

MD5
285fbdf961313a7ca8c314fd4d2111e4

SHA1
4945b9e2e7387fe5fa561b6987b0382b2c7b47a7

SHA256
5e74740fe83645d4a11d786273c57d2bb7089ff164dd859e837639038db2de0a

SHA512
364ae00fdbfaf65b2d51f451c9809a91077d28212c056a638fa96490cc34762354c4ce7aea79ed77e662a6796ce8ef5630c4f176e2b284f0edef1cab5911af4c

Download Submit
memory/2636-3-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/2636-5-0x0000000010000000-0x00000000101A0000-memory.dmp

Filesize
1.6MB

Download
memory/2636-23-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-39-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-47-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-24-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-37-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-38-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-51-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-40-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-41-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-42-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-43-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-44-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-45-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-46-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-50-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-48-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/3628-49-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/4324-26-0x0000000000400000-0x00000000008D8000-memory.dmp

Filesize
4.8MB

Download
memory/4324-15-0x0000000010000000-0x00000000101A0000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing