gh0strat | b570bb151f66847a7c06f0f8a4630a9982fd4742e3ea85b93807d856929fc457

Analysis

max time kernel
12s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

content_1730298613069.scr
Size

248KB
MD5

dc38da17b0f0cc99f4831aba153bb28b
SHA1

b756ef1b0369e0822ed248363ae6c577d53a7834
SHA256

62856958c7571eacf182e9b38f59189d7681ac39513fe3d3778f4b0be4e6ede1
SHA512

2c5349b9555c7ddaa300652173eef422fdcfbe464b8f8fca9e2ac53088d860eb996c763506d8ca1fef9ae9a0fb4d9574c6faf164050deb8f27646607f1699f8c
SSDEEP

3072:whLXC/6ZxsIDrok7gJWyzebqkqNKktNXBPmaoTZ2xZS21+GCI2ekEbkAsH3mYBoj:whL46Z6IDvgJM5QmahxZS2EGCtr3X7F

Score

10^/10

gh0strat purplefox discovery rat rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral6/memory/3752-16-0x0000000010000000-0x00000000101A4000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral6/memory/3752-16-0x0000000010000000-0x00000000101A4000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Purplefox family
purplefox
Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

content_1730298613069.scr

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	content_1730298613069.scr

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

content_1730298613069.scr

pid	Process
2700	content_1730298613069.scr
2700	content_1730298613069.scr

C:\Users\Admin\AppData\Local\Temp\content_1730298613069.scr
"C:\Users\Admin\AppData\Local\Temp\content_1730298613069.scr" /S
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2700
- C:\Users\Public\Windows\RuntimeBroker.exe
  "C:\Users\Public\Windows\RuntimeBroker.exe"
  2⤵
  PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Windows\RuntimeBroker.exe

Filesize
625KB

MD5
dec397e36e9f5e8a47040adbbf04e20b

SHA1
643f2b5b37723ebc493ba6993514a4b2d9171acb

SHA256
534fd2d6da5c361831eb7fbfd1b203fbb80cd363d33f69abc4eafc384bafdc5e

SHA512
b2cdd06c044ae8b4cf7ae5c32b65f2b03f733b93061b9076cf29103da53573460c7e5d53da72220055cdafb084c63019d4a134d562a06af81c1eaad30892845b

Download Submit
C:\Users\Public\Windows\UnityPlayer.dll

Filesize
1.6MB

MD5
cea3461efae340e8b3a054dba77d5e9a

SHA1
a7bf9fc78a957f8b0ab81e903af68f875a8684e9

SHA256
03012a1677c9a58183320b9b78036026ba94d6443878a20f7ca01463d5a73454

SHA512
be24e79dc90b22327420fcb5f5d5fb399b6ca95af55f28bbdcd58ed94e7d514f74c0377d7e4c6869e4f6d9db0724f3c7250a6a16f27aeaaf46068fa260e355ed

Download Submit
memory/3752-15-0x0000000077A11000-0x0000000077B31000-memory.dmp

Filesize
1.1MB

Download
memory/3752-16-0x0000000010000000-0x00000000101A4000-memory.dmp

Filesize
1.6MB

Download