gh0strat | 74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 22:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe
Size 4.5MB
Sample260731-14nymshd52
SHA256 74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3
MD5 a5e55145310c2c58092e91656442852d
SHA1 63b9d7a31487ca871ca1dee1d7c850a8da49cb3f
SHA512 81b8e4885104315773d5fedd046145fe0c25939018d478a47a06f3ce3ae495a9ac4a3905c0a96d4c805cd39b91819f690892c1829b0db7d20296e244716271f9
SSDEEP 49152:U89XJt4HIZ/Gg0P+WhMbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITi:NZJt4HIZOgmhMbXsPN5kiQaZ56
TLSH
T12426D42166D4CFE1D45F1070DC6ABAF6912BAD20CF564FCB6E807E1A35305D2AA31A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 11 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/4848-8-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4848-9-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4848-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3252-13-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3252-21-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2264-25-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3252-14-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2264-26-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2264-30-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3252-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2264-31-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 11 IoCs

resource	yara_rule
behavioral2/memory/4848-8-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4848-9-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4848-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3252-13-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3252-21-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2264-25-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3252-14-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2264-26-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2264-30-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3252-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/2264-31-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 4 IoCs

pid	Process
4848	QQ.exe
3252	TXPlatforn.exe
2264	TXPlatforn.exe
2472	HD_74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	QQ.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	QQ.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4848-8-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4848-9-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4848-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4848-5-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3252-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3252-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2264-25-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3252-14-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2264-26-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2264-30-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3252-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/2264-31-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3252-11-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2256	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatforn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2256	cmd.exe
3404	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3404	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2444	74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe
2444	74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2264	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4848	QQ.exe
Token: SeLoadDriverPrivilege	2264	TXPlatforn.exe
Token: 33	2264	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2264	TXPlatforn.exe
Token: 33	2264	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	2264	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2444	74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe
2444	74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 4848	2444	74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe	89
PID 4848 wrote to memory of 2256	4848	QQ.exe	91
PID 3252 wrote to memory of 2264	3252	TXPlatforn.exe	92
PID 2444 wrote to memory of 2472	2444	74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe	94
PID 2256 wrote to memory of 3404	2256	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe
"C:\Users\Admin\AppData\Local\Temp\74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\QQ.exe
  C:\Users\Admin\AppData\Local\Temp\\QQ.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\QQ.exe > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3404
- C:\Users\Admin\AppData\Local\Temp\HD_74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe
  C:\Users\Admin\AppData\Local\Temp\HD_74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2472

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HD_74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_74006b12dee29a003d9d939a198d14a3b5193b05a6005b771faefc873d66ecd3.exe
Size 3.1MB
SHA256 f130b3789962d5c8b59aa250d6f26ad5945928f3905b32bf65aa7bd30348a794
MD5 fb083acd60fe5c3156dc25442be815e3
SHA1 61df59b8f3ebd8b3d29ca3aedc4995e23cacf6d8
SHA512 7147337d2c1006bb15cfa967c9eea6826b63c8d343f866e7454d7368d25019f39e52cf179500810834244c3ca9644d6c0df0b2c3128a9051e9ee6b428fa926f6
SSDEEP 49152:0bXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27PLhp:0bXsPN5kiQaZ56
TLSH
T14BE5802126D4CFE1D46F20B0DD66BAF6512BAD24CF564FCB6D803E1A35305D2AA31A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.4MB
SHA256 127a6f90946296a589cb72912f44c1dd6fc264c9cdbcbdc8a725d96a6d0eedca
MD5 7aaccb96f61589448377314f5137502a
SHA1 14c916bf3fea812283bab73a3842afecbbe24729
SHA512 cf9bea1a242334a8a2c98237b00bdaf1afa893b7cf633d8566914461a0289c692015573bc8919c090c3ae2443c0b8805047b044c9e51e90aa073bac0197138a2
SSDEEP 24576:U89tv9/7JtDElDEExIecl1erdg0MCiVWhR/cl1:U89XJt4HIZ/Gg0P+Whi
TLSH
T1DA659D52B681CFB1C60F1430C8AA57FA9A775F41CE128BC3A3D4FE1D39B2191A636167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QQ.exe

Path C:\Users\Admin\AppData\Local\Temp\QQ.exe
Size 377KB
SHA256 bb43f73ddd5d04adcd723061ccf3a535387fa439aba0039d39a72f5d6ae3062b
MD5 3d6e7db5800f1dadb016cbf989749e3c
SHA1 7c09c438a352cbc4de5d7279bf07d36e8f6cbfef
SHA512 a98392c694a662a243581bc07582bffa9f425c4bd9acf2a68c19fbe95ee64f95ed4ca3100802736f67eea809a95fbf4f5e357800d3fa21f9d57b1f8d07d1462c
SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YoL7:HclcceBKlKwAg0Mja/UafOVwbhR
TLSH
T10A841241FF520127C74AB0B5C9984E7F8E7A43888E550C3A7F795E4E1B603EE6923D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2264-25-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2264-31-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2264-30-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/2264-26-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3252-14-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3252-21-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3252-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3252-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3252-11-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4848-5-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4848-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4848-9-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4848-8-0x0000000010000000-0x00000000101B6000-memory.dmp

Download