gh0strat | db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe
Size 4.6MB
Sample260724-ql62dsgd33
SHA256 db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61
MD5 40eec81b555a9fa40f44a2fb1d3648bc
SHA1 429684321eb7ff423106ebb5e18a4d686faae0a0
SHA512 c7fcc974d51d33ff72e26c2c7aa4f2cc7dd4ebbdce484d5ca21088b8dc80a9bc7d9277f7b08b8fa9222d49f62832a4badfcb83e1456892cb46763f356abaa9b5
SSDEEP 49152:v89XJt4HIZ/Gg0P+WhAJbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8Im:kZJt4HIZOgmhAJbXsPN5kiQaZ56
TLSH
T15C26E42166D4CFE1D05F1070DC6ABAF6912BAD20CF564FCB6E847E1A35305D2AA31A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 7 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/5684-10-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/5684-9-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/264-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/264-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1868-27-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1868-31-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1868-34-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/5684-10-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/5684-9-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/264-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/264-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1868-27-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1868-31-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1868-34-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 4 IoCs

pid	Process
5684	QQ.exe
264	TXPlatforn.exe
1868	TXPlatforn.exe
6120	HD_db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	QQ.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	QQ.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5684-10-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/5684-9-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/5684-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/264-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/264-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/264-14-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1868-27-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1868-31-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1868-34-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6048	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatforn.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6048	cmd.exe
4356	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4356	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5836	db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe
5836	db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1868	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5684	QQ.exe
Token: SeLoadDriverPrivilege	1868	TXPlatforn.exe
Token: 33	1868	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	1868	TXPlatforn.exe
Token: 33	1868	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	1868	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5836	db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe
5836	db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 5684	5836	db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe	89
PID 5684 wrote to memory of 6048	5684	QQ.exe	91
PID 264 wrote to memory of 1868	264	TXPlatforn.exe	92
PID 5836 wrote to memory of 6120	5836	db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe	94
PID 6048 wrote to memory of 4356	6048	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe
"C:\Users\Admin\AppData\Local\Temp\db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Users\Admin\AppData\Local\Temp\QQ.exe
  C:\Users\Admin\AppData\Local\Temp\\QQ.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\QQ.exe > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:6048
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4356
- C:\Users\Admin\AppData\Local\Temp\HD_db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe
  C:\Users\Admin\AppData\Local\Temp\HD_db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6120

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:264
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:1868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.5MB
SHA256 14e4b10081ff1409a687c463a73e6644e67399ea4c215325109e63120174435f
MD5 b96834acd3f366d5df6db365a482de61
SHA1 6ee0e5767032f5cf034d4b83b9f0bed9c724be67
SHA512 e1fcd01102a48454e3a11bb863ed49769ce049693726d155f839bfb68123f1f99fae5b15f33f65455516905f83221f487e0531073bef3089285c685fed6c7c13
SSDEEP 24576:v89tv9/7JtDElDEExIecl1erdg0MCiVWhR/1QP:v89XJt4HIZ/Gg0P+WhAP
TLSH
T1E8758D42B681CF71C50F1030C8AB97F59B675E41CE128BC7A798FE193DB2291AA37167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_db5d5030f9684363fd96e34725e978c2b253d9efc7c2cf7b6f0e22a338e81a61.exe
Size 3.1MB
SHA256 f130b3789962d5c8b59aa250d6f26ad5945928f3905b32bf65aa7bd30348a794
MD5 fb083acd60fe5c3156dc25442be815e3
SHA1 61df59b8f3ebd8b3d29ca3aedc4995e23cacf6d8
SHA512 7147337d2c1006bb15cfa967c9eea6826b63c8d343f866e7454d7368d25019f39e52cf179500810834244c3ca9644d6c0df0b2c3128a9051e9ee6b428fa926f6
SSDEEP 49152:0bXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27PLhp:0bXsPN5kiQaZ56
TLSH
T14BE5802126D4CFE1D46F20B0DD66BAF6512BAD24CF564FCB6D803E1A35305D2AA31A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QQ.exe

Path C:\Users\Admin\AppData\Local\Temp\QQ.exe
Size 377KB
SHA256 bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
MD5 3d6e7db5800f1dadb016cbf989749e3c
SHA1 7c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA512 a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YoL7:HclcceBKlKwAg0Mja/UafOVwbhR
TLSH
T10A841241FF520127C74AB0B5C9984E7F8E7A43888E550C3A7F795E4E1B603EE6923D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/264-17-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/264-14-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/264-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1868-27-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1868-26-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1868-31-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1868-34-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/5684-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/5684-11-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5684-9-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/5684-10-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/5836-0-0x0000000000400000-0x00000000005AE000-memory.dmp

Download

memory/5836-1-0x0000000000480000-0x0000000000481000-memory.dmp

Download

memory/5836-79-0x0000000000400000-0x00000000005AE000-memory.dmp

Download