gh0strat | f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59

Analysis

max time kernel
150s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe
Size

2.8MB
MD5

28cc1e21cc767b41f35cc5c8d702eb0f
SHA1

b2c66beb66f71eb7b28b2c3c9c58ad2b52dcf3d4
SHA256

f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59
SHA512

8afd12724240c2c8a2c2efef309f201c4b1fb252d1cd14ebd764f0a43ea3e4c53fff7b84f8b3ca7705a92b0134f6ae2919ed78922cfc45ce195af7b0a0a96d7e
SSDEEP

49152:u09XJt4HIN2H2tFvduySeg87tjrlkWNE3LOEpFRMwX70Ld:fZJt4HINy2LkbwwOEpFRp4

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 11 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral2/memory/1040-10-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1040-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1040-6-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1092-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1092-17-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1092-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1092-23-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4584-24-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4584-27-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4584-34-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/4584-35-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 11 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1040-10-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1040-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1040-6-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1092-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1092-17-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1092-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1092-23-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4584-24-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4584-27-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4584-34-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/4584-35-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Drops file in Drivers directory 1 IoCs

Processes:

TXPlatforn.exe

description ioc process

File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe
Sets service image path in registry 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

TXPlatforn.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe
Executes dropped EXE 4 IoCs

Processes:

RVN.exeTXPlatforn.exeTXPlatforn.exeHD_f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe

pid process

1040 RVN.exe
1092 TXPlatforn.exe
4584 TXPlatforn.exe
1156 HD_f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe

description	ioc	process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

pid	process
1040	RVN.exe
1092	TXPlatforn.exe
4584	TXPlatforn.exe
1156	HD_f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1040-4-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1040-10-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1040-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1040-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1092-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1092-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1092-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1092-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1092-23-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4584-24-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4584-27-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4584-34-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/4584-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

Processes:

RVN.exe

description ioc process

File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe

description	ioc	process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

Drops file in Program Files directory 5 IoCs

Processes:

f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe

description	ioc	process
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

380 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe

pid process

4524 f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe
4524 f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatforn.exe

pid process

4584 TXPlatforn.exe

pid	process
380	PING.EXE

pid	process
4524	f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe
4524	f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe

pid	process
4584	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

RVN.exeTXPlatforn.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1040	RVN.exe
Token: SeLoadDriverPrivilege	4584	TXPlatforn.exe
Token: 33	4584	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	4584	TXPlatforn.exe
Token: 33	4584	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	4584	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe

pid process

4524 f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe
4524 f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe

pid	process
4524	f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe
4524	f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exeRVN.exeTXPlatforn.execmd.exe

description	pid	process	target process
PID 4524 wrote to memory of 1040	4524	f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe	RVN.exe
PID 4524 wrote to memory of 1040	4524	f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe	RVN.exe
PID 4524 wrote to memory of 1040	4524	f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe	RVN.exe
PID 1040 wrote to memory of 2772	1040	RVN.exe	cmd.exe
PID 1040 wrote to memory of 2772	1040	RVN.exe	cmd.exe
PID 1040 wrote to memory of 2772	1040	RVN.exe	cmd.exe
PID 1092 wrote to memory of 4584	1092	TXPlatforn.exe	TXPlatforn.exe
PID 1092 wrote to memory of 4584	1092	TXPlatforn.exe	TXPlatforn.exe
PID 1092 wrote to memory of 4584	1092	TXPlatforn.exe	TXPlatforn.exe
PID 2772 wrote to memory of 380	2772	cmd.exe	PING.EXE
PID 2772 wrote to memory of 380	2772	cmd.exe	PING.EXE
PID 2772 wrote to memory of 380	2772	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe
"C:\Users\Admin\AppData\Local\Temp\f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524

C:\Users\Admin\AppData\Local\Temp\RVN.exe
C:\Users\Admin\AppData\Local\Temp\\RVN.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:380

C:\Users\Admin\AppData\Local\Temp\HD_f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe
C:\Users\Admin\AppData\Local\Temp\HD_f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe
2⤵
- Executes dropped EXE
PID:1156

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4584

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Filesize
1.4MB

MD5
582a058efe1bc4559ccf20e4c701174f

SHA1
4cadf1dc8b189fa71b3207582697a62604792587

SHA256
ecb77c2fcc1d0cc0b33e9d3e31d61983b7f5c5c849b0653545be8322ac7b6283

SHA512
3de2f758eae766aa03ae1d52938f9652cd2a00a281f02a8d38187cb73e7612fc6725d49fcc7f550f05c731ee39dce4bee72616fce99bea19c1310bfd032c42d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_f2b35bea4f692b97881d30e1d90a2bddecd151278a48a0ccca6ce3fb162a6b59.exe
Filesize
1.4MB

MD5
e130a3fb54dcecfce5a84183c3a46e94

SHA1
fa28396d63493191d50542e03097752b38c9a0da

SHA256
c2b9ac525d167f0ce13a1a0b20a75b889b8af8ca7fc99fbd279e94ba19bdb535

SHA512
c0a412abfcf3435bd87feaae90a7740befba43b98dda7c8d956453eadd8ef8b7acba1b1665e74489214c3d13ad4188e233f57d93a6cfffd0d3461570e23c8689

Download Submit
C:\Users\Admin\AppData\Local\Temp\RVN.exe
Filesize
377KB

MD5
80ade1893dec9cab7f2e63538a464fcc

SHA1
c06614da33a65eddb506db00a124a3fc3f5be02e

SHA256
57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

SHA512
fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

Download Submit
memory/1040-4-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1040-10-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1040-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1040-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1092-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1092-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1092-23-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1092-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1092-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4584-24-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4584-27-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4584-34-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/4584-35-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download