gh0strat | bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe
Size

2.9MB
MD5

fe86e62f1f8cc2b9160c316c7e1ccffd
SHA1

540ed568fad46b2e4bccd6460e98e7e07a78068f
SHA256

bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af
SHA512

1cbe0eba13af47bfa1781d766dfaab6a0a185afa8f48694b5aab25c20a557101b69b63977a04c4cef0f9b5fde66deaea888e459f755fdee99c061e63f7eeb48a
SSDEEP

49152:Mh2n9VNAIW4k4W6fskkkF+SHU932E0DIR:Msn9Vhek2rv0DIR

Score

10^/10

gh0strat purplefox discovery persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 4 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral2/memory/11808-21919-0x0000000010000000-0x00000000101B5000-memory.dmp	purplefox_rootkit
behavioral2/memory/11808-21918-0x0000000010000000-0x00000000101B5000-memory.dmp	purplefox_rootkit
behavioral2/memory/11404-29924-0x0000000010000000-0x00000000101B5000-memory.dmp	purplefox_rootkit
behavioral2/memory/11404-31253-0x0000000010000000-0x00000000101B5000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/11808-21919-0x0000000010000000-0x00000000101B5000-memory.dmp	family_gh0strat
behavioral2/memory/11808-21918-0x0000000010000000-0x00000000101B5000-memory.dmp	family_gh0strat
behavioral2/memory/11404-29924-0x0000000010000000-0x00000000101B5000-memory.dmp	family_gh0strat
behavioral2/memory/11404-31253-0x0000000010000000-0x00000000101B5000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Purplefox family
purplefox

Drops file in Drivers directory 1 IoCs

Processes:

Serveri.dll

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	Serveri.dll

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Serveri.dll

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	Serveri.dll

Drops startup file 1 IoCs

Processes:

bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe.lnk	bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe

Executes dropped EXE 4 IoCs

Processes:

Serveri.dllServeri.dllServeri.dllPhxph.exe

pid	Process
3760	Serveri.dll
11808	Serveri.dll
11404	Serveri.dll
25492	Phxph.exe

Drops file in System32 directory 5 IoCs

Processes:

bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exeServeri.dll

description	ioc	Process
File created	C:\Windows\SysWOW64\Serveri.dll	bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe
File opened for modification	C:\Windows\SysWOW64\Serveri.dll	bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe
File created	C:\Windows\SysWOW64\Phxph.exe	Serveri.dll
File opened for modification	C:\Windows\SysWOW64\Phxph.exe	Serveri.dll
File opened for modification	C:\Windows\SysWOW64\Serveri.dll	Serveri.dll

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

Processes:

Serveri.dllServeri.dllPhxph.exe

pid	Process
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
25492	Phxph.exe
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11404	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11808	Serveri.dll
11404	Serveri.dll

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/11808-21919-0x0000000010000000-0x00000000101B5000-memory.dmp	upx
behavioral2/memory/11808-21918-0x0000000010000000-0x00000000101B5000-memory.dmp	upx
behavioral2/memory/11808-21916-0x0000000010000000-0x00000000101B5000-memory.dmp	upx
behavioral2/memory/11404-29924-0x0000000010000000-0x00000000101B5000-memory.dmp	upx
behavioral2/memory/11404-31253-0x0000000010000000-0x00000000101B5000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exeServeri.dllServeri.dllPhxph.exeServeri.dllcmd.exePING.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Serveri.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Serveri.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phxph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Serveri.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

cmd.exePING.EXE

pid	Process
10444	cmd.exe
10412	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
10412	PING.EXE

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

Serveri.dll

pid	Process
11404	Serveri.dll

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Serveri.dllServeri.dll

description	pid	Process
Token: SeLoadDriverPrivilege	11404	Serveri.dll
Token: SeIncBasePriorityPrivilege	11808	Serveri.dll
Token: 33	11404	Serveri.dll
Token: SeIncBasePriorityPrivilege	11404	Serveri.dll
Token: 33	11404	Serveri.dll
Token: SeIncBasePriorityPrivilege	11404	Serveri.dll

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe

pid	Process
2188	bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe
2188	bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exeServeri.dllcmd.exe

description	pid	Process	procid_target
PID 2188 wrote to memory of 3760	2188	bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe	85
PID 2188 wrote to memory of 3760	2188	bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe	85
PID 2188 wrote to memory of 3760	2188	bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe	85
PID 2188 wrote to memory of 11808	2188	bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe	87
PID 2188 wrote to memory of 11808	2188	bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe	87
PID 2188 wrote to memory of 11808	2188	bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe	87
PID 2188 wrote to memory of 11404	2188	bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe	89
PID 2188 wrote to memory of 11404	2188	bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe	89
PID 2188 wrote to memory of 11404	2188	bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe	89
PID 11808 wrote to memory of 10444	11808	Serveri.dll	96
PID 11808 wrote to memory of 10444	11808	Serveri.dll	96
PID 11808 wrote to memory of 10444	11808	Serveri.dll	96
PID 10444 wrote to memory of 10412	10444	cmd.exe	98
PID 10444 wrote to memory of 10412	10444	cmd.exe	98
PID 10444 wrote to memory of 10412	10444	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe
"C:\Users\Admin\AppData\Local\Temp\bac9522027f995192c65ef3695741d690c3d1e43c15db42f42e52f3018db64af.exe"
1⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\Serveri.dll
  C:\Windows\system32\\Serveri.dll
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3760
- C:\Windows\SysWOW64\Serveri.dll
  C:\Windows\system32\\Serveri.dll
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:11808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Windows\SysWOW64\Serveri.dll > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:10444
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:10412
- C:\Windows\SysWOW64\Serveri.dll
  C:\Windows\system32\\Serveri.dll
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:11404

C:\Windows\SysWOW64\Phxph.exe
C:\Windows\SysWOW64\Phxph.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:25492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Phxph.exe

Filesize
22.1MB

MD5
44d1ce29474bad8ada3d778af1dac0f3

SHA1
319f966cc44529a564f9d5d19e0fb99e0af2ea19

SHA256
d75217eccc9e4b9a2ccfb2819b1fdbf01a074042292bcf3162ec27a01b7ee1cf

SHA512
511ac3bfa10928190c7cb035a976c673fb758950ce4accde4a80b81b62ee0585d5d51930571ffa177fb1d63ecd4a770415bc09800cc5cd1ac6cb7efa16b7d025

Download Submit
C:\Windows\SysWOW64\Serveri.dll

Filesize
1.1MB

MD5
1144ea1e19cb2a42f7ad2fa04db8e476

SHA1
2ef6e0f9c5e57305bff6d30080cf68c1d3e101d9

SHA256
20569e9045f5c150eafa51752334b62c78b9dbc308d61dacfcb2098a76c5cf50

SHA512
3df308eafc0f014a07fbdeb706b32eb5de7e02a7496e70e5035d9b76db239435a2511964fc027380aad19763755c4e07e52f4e157b691c55c5a03d5b21593556

Download Submit
memory/3760-6-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/3760-7-0x0000000077AE0000-0x0000000077CF5000-memory.dmp

Filesize
2.1MB

Download
memory/3760-29925-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/11404-29430-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/11404-31253-0x0000000010000000-0x00000000101B5000-memory.dmp

Filesize
1.7MB

Download
memory/11404-10742-0x0000000077AE0000-0x0000000077CF5000-memory.dmp

Filesize
2.1MB

Download
memory/11404-19549-0x00000000777C0000-0x0000000077960000-memory.dmp

Filesize
1.6MB

Download
memory/11404-29924-0x0000000010000000-0x00000000101B5000-memory.dmp

Filesize
1.7MB

Download
memory/11404-22240-0x0000000075DA0000-0x0000000075E1A000-memory.dmp

Filesize
488KB

Download
memory/11404-29923-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/11404-29431-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/11808-9165-0x0000000075DA0000-0x0000000075E1A000-memory.dmp

Filesize
488KB

Download
memory/11808-3280-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/11808-21312-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/11808-24748-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/11808-21311-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/11808-21916-0x0000000010000000-0x00000000101B5000-memory.dmp

Filesize
1.7MB

Download
memory/11808-21918-0x0000000010000000-0x00000000101B5000-memory.dmp

Filesize
1.7MB

Download
memory/11808-21919-0x0000000010000000-0x00000000101B5000-memory.dmp

Filesize
1.7MB

Download
memory/11808-7156-0x00000000777C0000-0x0000000077960000-memory.dmp

Filesize
1.6MB

Download
memory/11808-3281-0x0000000077AE0000-0x0000000077CF5000-memory.dmp

Filesize
2.1MB

Download
memory/25492-29432-0x0000000077AE0000-0x0000000077CF5000-memory.dmp

Filesize
2.1MB

Download
memory/25492-33318-0x00000000777C0000-0x0000000077960000-memory.dmp

Filesize
1.6MB

Download
memory/25492-35327-0x0000000075DA0000-0x0000000075E1A000-memory.dmp

Filesize
488KB

Download
memory/25492-42513-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download