gh0strat | d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 21:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe
Size 2.2MB
Sample260729-zzyfvagj21
SHA256 d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf
MD5 afae7afb672b4389ef9503e2a50b7040
SHA1 4df74abb8cc027740d16abdb39668d7e55b87673
SHA512 33d52d7b3bdb062206829ee95e01d0bd1c14b3430e40456e70566223136a4b0ba5d2f3d3c90f9260c30202bdc87cd9b7d5f32258299ea1a117d06d959f22db0f
SSDEEP 49152:l09XJt4HIN2H2tFvduySZpejKs3P5x2LwZPItx2apeapelI:GZJt4HINy2LkWjKs3P5x2LJtUvlI
TLSH
T1F7B5CF43F68185F5D409A434549A6733EAB37E404F2186CB5BA8FE1E3E712D12B7E22D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 11 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/2284-8-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2284-9-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2284-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2796-14-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2796-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2796-13-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2796-23-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3268-22-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3268-35-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3268-38-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3268-64-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 11 IoCs

resource	yara_rule
behavioral2/memory/2284-8-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2284-9-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2284-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2796-14-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2796-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2796-13-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2796-23-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3268-22-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3268-35-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3268-38-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3268-64-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 4 IoCs

pid	Process
2284	RVN.exe
2796	TXPlatforn.exe
3268	TXPlatforn.exe
6016	HD_d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2284-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2284-8-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2284-9-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2284-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2796-14-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2796-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2796-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2796-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3268-22-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3268-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3268-38-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2796-11-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3268-64-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3956	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RVN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatforn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3956	cmd.exe
1916	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1916	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4436	d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe
4436	d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3268	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2284	RVN.exe
Token: SeLoadDriverPrivilege	3268	TXPlatforn.exe
Token: 33	3268	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	3268	TXPlatforn.exe
Token: 33	3268	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	3268	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4436	d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe
4436	d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 2284	4436	d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe	88
PID 2284 wrote to memory of 3956	2284	RVN.exe	91
PID 2796 wrote to memory of 3268	2796	TXPlatforn.exe	92
PID 3956 wrote to memory of 1916	3956	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe
"C:\Users\Admin\AppData\Local\Temp\d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Local\Temp\RVN.exe
  C:\Users\Admin\AppData\Local\Temp\\RVN.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1916
- C:\Users\Admin\AppData\Local\Temp\HD_d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe
  C:\Users\Admin\AppData\Local\Temp\HD_d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe
  2⤵
  - Executes dropped EXE
  PID:6016

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:3268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.6MB
SHA256 b0858bbc0b6786567833868a7dddc12bed7458fbe5747e12f8be0c7599ae4602
MD5 5d97e538c8b5e56ef400d22c43f25206
SHA1 599c1a46c79c3ae04df35482315670d63adabc05
SHA512 7d211c45b6186525be85bb36973f8804abee150393d2e740ec88143326061c8146f0313520ebdd4e156268b0760bbb2cf1dfa5b474a01d9bc4b43046c2e8db29
SSDEEP 49152:l09XJt4HIN2H2tFvduySZpejKs3P5x2LB:GZJt4HINy2LkWjKs3P5x2LB
TLSH
T17475BE93F68084F1D9082834549A3B32EBB36F418E25C6CB97A8FD1E39711516D7B27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_d095b599a4c2ddb327adf5b5f902cd7d4cb0babbeabd63c47fd54731eb5923bf.exe
Size 645KB
SHA256 7addb2269266ac471a690802cab54539b40c2ae5b31e2120fdcf8dfb0ed15dc7
MD5 00eae789b0aab1b0fbd23b830fbf1064
SHA1 e4e5fd089f6ae17c83f073cf91edc9db8189980d
SHA512 23a0e06b39f8b5a932ae5b8f60704ba265332b341ac8bab5b74b2f31f04ce8c7fe6f77278d70c7685cfa894ab0e25a70d89990f5f643b54c07337f90fa5943fb
SSDEEP 12288:HNpZY93s7p1R0Ys/tx2tzwHJem7OzwHJe0Ihf7M:HNpZY67zRfItx2hwpemIwpelDM
TLSH
T13DE47D03F74516B9E08AE5B49B52D233E5723C840B6161CB1BA93F2A3F756D02B7972C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RVN.exe

Path C:\Users\Admin\AppData\Local\Temp\RVN.exe
Size 377KB
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
SSDEEP 6144:BEo7J1ixs4uVKE9rFEAHKThrBSq2hAzSM5mDo9lSJULHZqExlD2E1LxhJVwIe0Dy:Wo2HQVWAHkFSq2hAWJYlMUtrxlyuJVRq
TLSH
T13A841221EB1265A2D30BB0F0CE685F0688B953584C6D1D57EEB51E2D7D3A3EDE832D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2284-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2284-9-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2284-8-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2284-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2796-14-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2796-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2796-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2796-23-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2796-11-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3268-22-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3268-35-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3268-38-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3268-64-0x0000000010000000-0x00000000101B6000-memory.dmp

Download