Analysis
- max time kernel
123s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
22/01/2022, 08:05
General
- Target 3ec149660a6808f711ca6cb6b20c1dda.exe
- Size 658KB
- Sample220122-jyv2bsaddr
- SHA256 2d288f2cd6752a01360f2669959e2c61f676f8156d5cc40d4b415245ae04cf6d
Malware Config
Extracted
-
purplefox
-
Sainbox
-
193.218.38.93
Extracted
-
purplefox
Signatures
- Detect PurpleFox Dropper 5 IoCs
Detect PurpleFox Dropper.
- Detect PurpleFox Rootkit 6 IoCs
Detect PurpleFox Rootkit.
- PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
- suricata: ET MALWARE OneLouder EXE download possibly installing Zeus P2P
suricata: ET MALWARE OneLouder EXE download possibly installing Zeus P2P
- suricata: ET MALWARE Probable OneLouder downloader (Zeus P2P) exe download
suricata: ET MALWARE Probable OneLouder downloader (Zeus P2P) exe download
- suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Request M1
suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Request M1
- suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Server Response M1
suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Server Response M1
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ec149660a6808f711ca6cb6b20c1dda.exe"C:\Users\Admin\AppData\Local\Temp\3ec149660a6808f711ca6cb6b20c1dda.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Videos\1639137659\7zz.exe"C:\Users\Public\Videos\1639137659\7zz.exe" X -ep2 C:\Users\Public\Videos\1639137659\1.rar C:\Users\Public\Videos\16391376592⤵
- Executes dropped EXE
-
-
C:\Users\Public\Videos\1639137659\ojbkcg.exe"C:\Users\Public\Videos\1639137659\ojbkcg.exe" -a2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Public\Documents\auto\111.exe"C:\Users\Public\Documents\auto\111.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\7z.exe"C:\ProgramData\7z.exe" x C:\ProgramData\bb.zip -oC:\Users\Admin\AppData\Roaming\Microsoft\Windows2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
222.lnk
7z.dll
7z.exe
7z.exe
bb.zip
svchost.txt
111.exe
111.exe
update.ini
1.rar
360.tct
7zz.exe
ojbkcg.exe
ojbkcg.exe
rundll3222.exe
svchost.txt
7z.dll
360.tct
memory/728-193-0x00000228A3650000-0x00000228A3EC5000-memory.dmp
memory/728-188-0x0000000180000000-0x00000001808AB000-memory.dmp