Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-01-2022 09:07
Static task
static1
Behavioral task
behavioral1
Sample
f373ebb32b2a836b78f932fd436ec49a.exe
Resource
win7-en-20211208
General
-
Target
f373ebb32b2a836b78f932fd436ec49a.exe
-
Size
492KB
-
MD5
f373ebb32b2a836b78f932fd436ec49a
-
SHA1
fdf344a3d5684433e689b61de782d5bd29f185b9
-
SHA256
47d178214e35dc1d7dca9886abd3fc3e715a934c5e8540e9f0879d5d1c8addee
-
SHA512
b5fadc8d050d2bae9b1f657f33d8b23d6ac0eb39fb962a64059fe5e39c73a85e5f998a53622e06811616c55d037b115a853794841a2f16354b65af3ca1ffdb48
Malware Config
Extracted
purplefox
Sainbox
193.218.38.93
Extracted
purplefox
Signatures
-
Processes:
yara_rule purplefox_dropper purplefox_dropper C:\Users\Public\Videos\1642583231\svchost.txt purplefox_dropper C:\ProgramData\svchost.txt purplefox_dropper behavioral1/memory/1908-67-0x0000000180000000-0x00000001808AB000-memory.dmp purplefox_dropper behavioral1/memory/1908-70-0x0000000001F30000-0x00000000027A5000-memory.dmp purplefox_dropper -
Processes:
yara_rule purplefox_rootkit purplefox_rootkit C:\Users\Public\Videos\1642583231\svchost.txt purplefox_rootkit C:\ProgramData\svchost.txt purplefox_rootkit behavioral1/memory/1908-67-0x0000000180000000-0x00000001808AB000-memory.dmp purplefox_rootkit behavioral1/memory/1908-70-0x0000000001F30000-0x00000000027A5000-memory.dmp purplefox_rootkit -
suricata: ET MALWARE OneLouder EXE download possibly installing Zeus P2P
suricata: ET MALWARE OneLouder EXE download possibly installing Zeus P2P
-
suricata: ET MALWARE Probable OneLouder downloader (Zeus P2P) exe download
suricata: ET MALWARE Probable OneLouder downloader (Zeus P2P) exe download
-
suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Request M1
suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Request M1
-
Executes dropped EXE 4 IoCs
Processes:
7zz.exeojbkcg.exe111.exe7z.exepid process 2020 7zz.exe 1908 ojbkcg.exe 2004 111.exe 1312 7z.exe -
Drops startup file 2 IoCs
Processes:
7z.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\╧╘┐¿╟²╢».lnk 7z.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\╧╘┐¿╟²╢».lnk 7z.exe -
Loads dropped DLL 8 IoCs
Processes:
f373ebb32b2a836b78f932fd436ec49a.exeojbkcg.exe111.exe7z.exepid process 1600 f373ebb32b2a836b78f932fd436ec49a.exe 1600 f373ebb32b2a836b78f932fd436ec49a.exe 1908 ojbkcg.exe 2004 111.exe 2004 111.exe 2004 111.exe 2004 111.exe 1312 7z.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f373ebb32b2a836b78f932fd436ec49a.exepid process 1600 f373ebb32b2a836b78f932fd436ec49a.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
7z.exedescription pid process Token: SeRestorePrivilege 1312 7z.exe Token: 35 1312 7z.exe Token: SeSecurityPrivilege 1312 7z.exe Token: SeSecurityPrivilege 1312 7z.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
111.exepid process 2004 111.exe 2004 111.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f373ebb32b2a836b78f932fd436ec49a.exe111.exedescription pid process target process PID 1600 wrote to memory of 2020 1600 f373ebb32b2a836b78f932fd436ec49a.exe 7zz.exe PID 1600 wrote to memory of 2020 1600 f373ebb32b2a836b78f932fd436ec49a.exe 7zz.exe PID 1600 wrote to memory of 2020 1600 f373ebb32b2a836b78f932fd436ec49a.exe 7zz.exe PID 1600 wrote to memory of 2020 1600 f373ebb32b2a836b78f932fd436ec49a.exe 7zz.exe PID 1600 wrote to memory of 1908 1600 f373ebb32b2a836b78f932fd436ec49a.exe ojbkcg.exe PID 1600 wrote to memory of 1908 1600 f373ebb32b2a836b78f932fd436ec49a.exe ojbkcg.exe PID 1600 wrote to memory of 1908 1600 f373ebb32b2a836b78f932fd436ec49a.exe ojbkcg.exe PID 1600 wrote to memory of 1908 1600 f373ebb32b2a836b78f932fd436ec49a.exe ojbkcg.exe PID 2004 wrote to memory of 1312 2004 111.exe 7z.exe PID 2004 wrote to memory of 1312 2004 111.exe 7z.exe PID 2004 wrote to memory of 1312 2004 111.exe 7z.exe PID 2004 wrote to memory of 1312 2004 111.exe 7z.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f373ebb32b2a836b78f932fd436ec49a.exe"C:\Users\Admin\AppData\Local\Temp\f373ebb32b2a836b78f932fd436ec49a.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Public\Videos\1642583231\7zz.exe"C:\Users\Public\Videos\1642583231\7zz.exe" X -ep2 C:\Users\Public\Videos\1642583231\1.rar C:\Users\Public\Videos\16425832312⤵
- Executes dropped EXE
PID:2020
-
-
C:\Users\Public\Videos\1642583231\ojbkcg.exe"C:\Users\Public\Videos\1642583231\ojbkcg.exe" -a2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908
-
-
C:\Users\Public\Documents\auto\111.exe"C:\Users\Public\Documents\auto\111.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\ProgramData\7z.exe"C:\ProgramData\7z.exe" x C:\ProgramData\bb.zip -oC:\Users\Admin\AppData\Roaming\Microsoft\Windows2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59ab5c0bbf40b2e1fc5f29a8e474dd215
SHA11d2716926c3c5086d7d10afdb5964b556e131993
SHA256f169d795ec6f5f75547655c79d359aca5f12834f3d79662865e82af902168f29
SHA5128a596e2aa516d3df834fa79803ace1cb8e2891f3e31876795fa40bda934ff6f97dc5023afcebf9f716c81cce498ce60bf6c1aec2ee079c13d9f534c1fa161f5b
-
Filesize
1.1MB
MD56a9e619a0392bb5918306f7fbaa8c85b
SHA1d18d392e078e703ef7d9ec2a4f2042d7fbbf3863
SHA2563beecf3d764daaffc020ba89dd764b0215fbd360bfc115fbb3880ef0672b98e5
SHA512565c8f27395c41d4778debd0dec63d6fafb703255093d6ad5aea5d8b26f768f8b7ff7b2fa37a710179d3c1c0c0f47075a471c73584eb8941ee38b9ea25dcf809
-
Filesize
301KB
MD5c808d5b1f96af6f1869d6b6cdbeffd20
SHA17818808f9f3f9719420d160f9c842a84eabdf73e
SHA256921226944015f01f2780179690b7bfcee7b92ea452fe85cae9375e49d64ee0b4
SHA512f89a936640d96e92a86fe0c84dbf3273343faf8850e691b750c916afcc4f0ac49ebe985f97279bd8033254c63eff4319721556d04491218448db992823aebe01
-
Filesize
301KB
MD5c808d5b1f96af6f1869d6b6cdbeffd20
SHA17818808f9f3f9719420d160f9c842a84eabdf73e
SHA256921226944015f01f2780179690b7bfcee7b92ea452fe85cae9375e49d64ee0b4
SHA512f89a936640d96e92a86fe0c84dbf3273343faf8850e691b750c916afcc4f0ac49ebe985f97279bd8033254c63eff4319721556d04491218448db992823aebe01
-
Filesize
1KB
MD5fd6745c7e6659a134b2388b81f743eb8
SHA1175c4e2e49d86f4a84a5fb675a86460cbdd291c0
SHA256793d02326504985024cd6afa21f0e1555855b59bc3a63442f0c51337ba74720a
SHA51224611c0e585d330ff82561f3586aaa57b07c044dafd1d0513e2257ec53a4eb63a9989be2112e1c0ac5d20e62a2e3ebaa932bfa4c3e5c29d4c8aef68542c3e0f1
-
Filesize
8.5MB
MD55ecefaea48c5a8498b036acd8ce411a5
SHA1501b3ed0fb6c33f6a122d603292d7fe04e8ce04f
SHA25688dd42dedc77e8ad117cc54d7b37083bbacaa6ecb84553bda31905b0a29e0e4d
SHA512e41a6bb1c734330dac37b9e7552053efdb46d15bf60601613baf8b5ab4be352c4d2f2d1c4e8bc4fe1616b98adfcf7b26336300b3bb724a9016e04d5820b2dd00
-
Filesize
328KB
MD526d1f8cc33a7567463bfaebc2242833c
SHA11bd4fa5729c289a3ca1c4955f52464e4cc5ec4da
SHA256cb201744a0f50e72ee4fda9298785fa16bfc4bf639a9474457e429278ff376bc
SHA51201b3909272b3b25a9601cef11fd1122660a56b5220e8b3187c1b27135a23cc9aee9926761ce64ca9d8d872719da420131d83d4556c6255d20579be28d274b445
-
Filesize
328KB
MD526d1f8cc33a7567463bfaebc2242833c
SHA11bd4fa5729c289a3ca1c4955f52464e4cc5ec4da
SHA256cb201744a0f50e72ee4fda9298785fa16bfc4bf639a9474457e429278ff376bc
SHA51201b3909272b3b25a9601cef11fd1122660a56b5220e8b3187c1b27135a23cc9aee9926761ce64ca9d8d872719da420131d83d4556c6255d20579be28d274b445
-
Filesize
39B
MD5ee5768d7d9e319e36f17476d12450785
SHA1e08648361310618ea81b793411def40cef9e1745
SHA256e21a77a762b943102a0bd1cd9909b4f2c310889b1e3144a1a1e39fc4f09667bf
SHA512daff15ba6de59d2078dcaee5c381a71c2047bc18782a442c6c9ed83fcea3cb3f00f7a99ddf3092785fd7d7d8b70ee1009a717845074d354ebecac484442dae06
-
Filesize
2.6MB
MD5ba08eccd1f00c25dfd65f666896893b7
SHA1e5ed83a57d12ba1e4df10483ce41f743807b2b22
SHA256f5806b666f9b416c0f649a53748d79a4e392988c09410689e032eeff71973620
SHA5120b295c2089b966f83cc2f51a599af692f74539f7a1e071113dfd13afd31f9bdd2bc8d2366cfc75c79cd90bc5067638ce48f8f1ff1e47eb6494c528bfef03ffb0
-
Filesize
254KB
MD5ccdffd31fa73286c21a7bef5fd899f15
SHA10a1df0830c295ae914fb2094f5eb9a5e8d6746cf
SHA256d70c4f4812884762d0c17060985d38bc24b2a777b7f3148d1bbabdacf4cb4c58
SHA512a865a1eab6b9a7ad8fd2860843536276548cdad3834918772ab5ea4b378ef7c5a8f680671031c9bb6449136da61e683c3f910a241402a4302628b47b91b3e348
-
Filesize
572KB
MD5f2ae502d448cfb81a5f40a9368d99b1a
SHA1f849be86e9e7ced0acd51a68f92992b8090d08a5
SHA25607ad4b984f288304003b080dd013784685181de4353a0b70a0247f96e535bd56
SHA5129f3aea471684e22bf9fc045ca0e47a8429fa0b13c188f9c7a51937efa8afcec976761b0c4c95aed7735096fcc2278bbd86b0ab581261a6aff6c694d7bb65e9be
-
Filesize
329KB
MD5979823a05959fb29275d8f2537886924
SHA136d58a7ca54ec317879cd2df0a1e6a640c987cc9
SHA256bc7efcee6c968970fc88d1fecfd855c7a70f29144024004099111ed1de7c7282
SHA512c2a54714d861283eda9693f8ca92f36cf6dd216168fdcf724771060337d807eff5383ac5f655ba65a03922ef929c6b0866a514e5228198e2fc5e7f47bac683b0
-
Filesize
329KB
MD5979823a05959fb29275d8f2537886924
SHA136d58a7ca54ec317879cd2df0a1e6a640c987cc9
SHA256bc7efcee6c968970fc88d1fecfd855c7a70f29144024004099111ed1de7c7282
SHA512c2a54714d861283eda9693f8ca92f36cf6dd216168fdcf724771060337d807eff5383ac5f655ba65a03922ef929c6b0866a514e5228198e2fc5e7f47bac683b0
-
Filesize
45KB
MD5c36bb659f08f046b139c8d1b980bf1ac
SHA1dd3247b225a8da3161f76055f31cbc5f64a66086
SHA256405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4
SHA5123eeae6a3b424fa1709b4443f625ee99fa2d2861661214b868d36bf5a63c0aaac61ad3bdd9c4b18cb9d820ef89653787df812289d31d65415c4dd08fd45d0c73f
-
Filesize
8.5MB
MD55ecefaea48c5a8498b036acd8ce411a5
SHA1501b3ed0fb6c33f6a122d603292d7fe04e8ce04f
SHA25688dd42dedc77e8ad117cc54d7b37083bbacaa6ecb84553bda31905b0a29e0e4d
SHA512e41a6bb1c734330dac37b9e7552053efdb46d15bf60601613baf8b5ab4be352c4d2f2d1c4e8bc4fe1616b98adfcf7b26336300b3bb724a9016e04d5820b2dd00
-
Filesize
1.1MB
MD56a9e619a0392bb5918306f7fbaa8c85b
SHA1d18d392e078e703ef7d9ec2a4f2042d7fbbf3863
SHA2563beecf3d764daaffc020ba89dd764b0215fbd360bfc115fbb3880ef0672b98e5
SHA512565c8f27395c41d4778debd0dec63d6fafb703255093d6ad5aea5d8b26f768f8b7ff7b2fa37a710179d3c1c0c0f47075a471c73584eb8941ee38b9ea25dcf809
-
Filesize
301KB
MD5c808d5b1f96af6f1869d6b6cdbeffd20
SHA17818808f9f3f9719420d160f9c842a84eabdf73e
SHA256921226944015f01f2780179690b7bfcee7b92ea452fe85cae9375e49d64ee0b4
SHA512f89a936640d96e92a86fe0c84dbf3273343faf8850e691b750c916afcc4f0ac49ebe985f97279bd8033254c63eff4319721556d04491218448db992823aebe01
-
Filesize
301KB
MD5c808d5b1f96af6f1869d6b6cdbeffd20
SHA17818808f9f3f9719420d160f9c842a84eabdf73e
SHA256921226944015f01f2780179690b7bfcee7b92ea452fe85cae9375e49d64ee0b4
SHA512f89a936640d96e92a86fe0c84dbf3273343faf8850e691b750c916afcc4f0ac49ebe985f97279bd8033254c63eff4319721556d04491218448db992823aebe01
-
Filesize
301KB
MD5c808d5b1f96af6f1869d6b6cdbeffd20
SHA17818808f9f3f9719420d160f9c842a84eabdf73e
SHA256921226944015f01f2780179690b7bfcee7b92ea452fe85cae9375e49d64ee0b4
SHA512f89a936640d96e92a86fe0c84dbf3273343faf8850e691b750c916afcc4f0ac49ebe985f97279bd8033254c63eff4319721556d04491218448db992823aebe01
-
Filesize
301KB
MD5c808d5b1f96af6f1869d6b6cdbeffd20
SHA17818808f9f3f9719420d160f9c842a84eabdf73e
SHA256921226944015f01f2780179690b7bfcee7b92ea452fe85cae9375e49d64ee0b4
SHA512f89a936640d96e92a86fe0c84dbf3273343faf8850e691b750c916afcc4f0ac49ebe985f97279bd8033254c63eff4319721556d04491218448db992823aebe01
-
Filesize
254KB
MD5ccdffd31fa73286c21a7bef5fd899f15
SHA10a1df0830c295ae914fb2094f5eb9a5e8d6746cf
SHA256d70c4f4812884762d0c17060985d38bc24b2a777b7f3148d1bbabdacf4cb4c58
SHA512a865a1eab6b9a7ad8fd2860843536276548cdad3834918772ab5ea4b378ef7c5a8f680671031c9bb6449136da61e683c3f910a241402a4302628b47b91b3e348
-
Filesize
572KB
MD5f2ae502d448cfb81a5f40a9368d99b1a
SHA1f849be86e9e7ced0acd51a68f92992b8090d08a5
SHA25607ad4b984f288304003b080dd013784685181de4353a0b70a0247f96e535bd56
SHA5129f3aea471684e22bf9fc045ca0e47a8429fa0b13c188f9c7a51937efa8afcec976761b0c4c95aed7735096fcc2278bbd86b0ab581261a6aff6c694d7bb65e9be
-
Filesize
329KB
MD5979823a05959fb29275d8f2537886924
SHA136d58a7ca54ec317879cd2df0a1e6a640c987cc9
SHA256bc7efcee6c968970fc88d1fecfd855c7a70f29144024004099111ed1de7c7282
SHA512c2a54714d861283eda9693f8ca92f36cf6dd216168fdcf724771060337d807eff5383ac5f655ba65a03922ef929c6b0866a514e5228198e2fc5e7f47bac683b0