purplefox | 2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2

Analysis

max time kernel
118s
max time network
159s
platform
windows7_x64
resource
win7-en-20211208
submitted
10-02-2022 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exe
Size

623KB
MD5

1466fa44b8e9be35982e0c248c62248b
SHA1

01ca7fc3bafca3b6362c084a5fa98cce03c4be2f
SHA256

2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2
SHA512

d0b97c7eabce818b143ccdb87adde6a201e404afe14cb282c109662257db8d0529583ad739eb9e72bba90fe2217fc34a40b37b94b916feaba010ed81eac2a265

Score

10^/10

purplefox sainbox loader dropper loader rootkit trojan

Malware Config

Extracted

Family

purplefox

http://107.151.94.70:4397/77

Extracted

Family

purplefox

Botnet

Sainbox

103.145.87.162

Extracted

Family

purplefox

Signatures

Detect PurpleFox Dropper 6 IoCs

Detect PurpleFox Dropper.

dropper loader

Processes:

yara_rule
purplefox_dropper
purplefox_dropper
C:\Users\Public\Videos\1644462859\svchost.txt	purplefox_dropper
C:\ProgramData\svchost.txt	purplefox_dropper
behavioral1/memory/1756-68-0x0000000180000000-0x00000001808AB000-memory.dmp	purplefox_dropper
behavioral1/memory/1756-72-0x0000000001F50000-0x00000000027C5000-memory.dmp	purplefox_dropper

Detect PurpleFox Rootkit 6 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

yara_rule
purplefox_rootkit
purplefox_rootkit
C:\Users\Public\Videos\1644462859\svchost.txt	purplefox_rootkit
C:\ProgramData\svchost.txt	purplefox_rootkit
behavioral1/memory/1756-68-0x0000000180000000-0x00000001808AB000-memory.dmp	purplefox_rootkit
behavioral1/memory/1756-72-0x0000000001F50000-0x00000000027C5000-memory.dmp	purplefox_rootkit

PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Executes dropped EXE 2 IoCs

Processes:

7zz.exeojbkcg.exe

pid process

1792 7zz.exe
1756 ojbkcg.exe

pid	process
1792	7zz.exe
1756	ojbkcg.exe

Loads dropped DLL 3 IoCs

Processes:

2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exeojbkcg.exe

pid	process
1492	2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exe
1492	2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exe
1756	ojbkcg.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ojbkcg.exe

description	ioc	process
File opened (read-only)	\??\R:	ojbkcg.exe
File opened (read-only)	\??\S:	ojbkcg.exe
File opened (read-only)	\??\B:	ojbkcg.exe
File opened (read-only)	\??\E:	ojbkcg.exe
File opened (read-only)	\??\J:	ojbkcg.exe
File opened (read-only)	\??\M:	ojbkcg.exe
File opened (read-only)	\??\T:	ojbkcg.exe
File opened (read-only)	\??\U:	ojbkcg.exe
File opened (read-only)	\??\Y:	ojbkcg.exe
File opened (read-only)	\??\Z:	ojbkcg.exe
File opened (read-only)	\??\H:	ojbkcg.exe
File opened (read-only)	\??\I:	ojbkcg.exe
File opened (read-only)	\??\K:	ojbkcg.exe
File opened (read-only)	\??\W:	ojbkcg.exe
File opened (read-only)	\??\F:	ojbkcg.exe
File opened (read-only)	\??\L:	ojbkcg.exe
File opened (read-only)	\??\V:	ojbkcg.exe
File opened (read-only)	\??\P:	ojbkcg.exe
File opened (read-only)	\??\Q:	ojbkcg.exe
File opened (read-only)	\??\X:	ojbkcg.exe
File opened (read-only)	\??\G:	ojbkcg.exe
File opened (read-only)	\??\N:	ojbkcg.exe
File opened (read-only)	\??\O:	ojbkcg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ojbkcg.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ojbkcg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ojbkcg.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exeojbkcg.exe

pid	process
1492	2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe
1756	ojbkcg.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exe

description	pid	process	target process
PID 1492 wrote to memory of 1792	1492	2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exe	7zz.exe
PID 1492 wrote to memory of 1792	1492	2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exe	7zz.exe
PID 1492 wrote to memory of 1792	1492	2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exe	7zz.exe
PID 1492 wrote to memory of 1792	1492	2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exe	7zz.exe
PID 1492 wrote to memory of 1756	1492	2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exe	ojbkcg.exe
PID 1492 wrote to memory of 1756	1492	2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exe	ojbkcg.exe
PID 1492 wrote to memory of 1756	1492	2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exe	ojbkcg.exe
PID 1492 wrote to memory of 1756	1492	2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exe	ojbkcg.exe

C:\Users\Admin\AppData\Local\Temp\2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exe
"C:\Users\Admin\AppData\Local\Temp\2b122f85cf860621631b430565495c65134cfb56233f92c8e9a4be509bbcead2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1492

C:\Users\Public\Videos\1644462859\7zz.exe
"C:\Users\Public\Videos\1644462859\7zz.exe" X -ep2 C:\Users\Public\Videos\1644462859\1.rar C:\Users\Public\Videos\1644462859
2⤵
- Executes dropped EXE
PID:1792

C:\Users\Public\Videos\1644462859\ojbkcg.exe
"C:\Users\Public\Videos\1644462859\ojbkcg.exe" -a
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svchost.txt
Filesize
8.5MB

MD5
f6ebcab162733b36fcdfddd15775f012

SHA1
13e3851f17b2c22cc14dd871d5a75d8744306fee

SHA256
143be3d067188ae89a2c003ef2671bbdd790d6026664078098117cc7fc3373ed

SHA512
98725414e1655542828e207176a67e66d403a9ca5ac1b139a70cd7fe72fb1f8d9740c0c06071edccfb985231448175da81f8b5c68381ad7e1d12a7ad0acce388

Download Submit
C:\Users\Public\Videos\1644462859\1.rar
Filesize
2.6MB

MD5
113606ab9a7bbcde784b0ca53637f1d4

SHA1
2876efce32bfdbb46a64ea50a4ac0adcbe2201c0

SHA256
5b51b5d82cf4038f89036009077a35e0824101cb3a564ccc763a3dd1f64ffa92

SHA512
6a0a5976649c7d9f3dfc86fefeef35af4a4b24f86b2c0c0d579f1d8c665b383c450133136bd603a12c808fbd5af94907380259932a2bd04795953f9aa9d5f088

Download Submit
C:\Users\Public\Videos\1644462859\360.tct
Filesize
253KB

MD5
b6ee97ccbebb6c4d06e1a7a7bb4ee1c8

SHA1
7451e21a49529eb7e42fc5fc03d6980fabc00c44

SHA256
87d3ea42604943d2230cc0b5aea499da41fc7db46d141abf96875692040e4699

SHA512
060d9790e31c71e9e9b3d132088c107a6ae79a707ae3654b4c7e5a9248fd610761c0c40c54f4930d36c0379b490e7bee1be5592da85e4fe4c3f5c4a1a2eddd12

Download Submit
C:\Users\Public\Videos\1644462859\7zz.exe
Filesize
572KB

MD5
f2ae502d448cfb81a5f40a9368d99b1a

SHA1
f849be86e9e7ced0acd51a68f92992b8090d08a5

SHA256
07ad4b984f288304003b080dd013784685181de4353a0b70a0247f96e535bd56

SHA512
9f3aea471684e22bf9fc045ca0e47a8429fa0b13c188f9c7a51937efa8afcec976761b0c4c95aed7735096fcc2278bbd86b0ab581261a6aff6c694d7bb65e9be

Download Submit
C:\Users\Public\Videos\1644462859\ojbkcg.exe
Filesize
171KB

MD5
e0923ede0d979012969c62063c74f44d

SHA1
f1dcf61b66745eff17702db4d4e4b6baa23bface

SHA256
8577bcbd02d38bce9601eb43511017b0bbc5176ebc3c48c08c81f755fcf216f4

SHA512
65d0ec789d6bfe423ce2b49c54ed26389bf61d9789cb7d2de857f4f24ab15815207bceedf191446e15fb9b0f3752489b3cda69ae85768a06a01654fa4e5a6d68

Download Submit
C:\Users\Public\Videos\1644462859\ojbkcg.exe
Filesize
171KB

MD5
e0923ede0d979012969c62063c74f44d

SHA1
f1dcf61b66745eff17702db4d4e4b6baa23bface

SHA256
8577bcbd02d38bce9601eb43511017b0bbc5176ebc3c48c08c81f755fcf216f4

SHA512
65d0ec789d6bfe423ce2b49c54ed26389bf61d9789cb7d2de857f4f24ab15815207bceedf191446e15fb9b0f3752489b3cda69ae85768a06a01654fa4e5a6d68

Download Submit
C:\Users\Public\Videos\1644462859\rundll3222.exe
Filesize
45KB

MD5
c36bb659f08f046b139c8d1b980bf1ac

SHA1
dd3247b225a8da3161f76055f31cbc5f64a66086

SHA256
405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4

SHA512
3eeae6a3b424fa1709b4443f625ee99fa2d2861661214b868d36bf5a63c0aaac61ad3bdd9c4b18cb9d820ef89653787df812289d31d65415c4dd08fd45d0c73f

Download Submit
C:\Users\Public\Videos\1644462859\svchost.txt
Filesize
8.5MB

MD5
f6ebcab162733b36fcdfddd15775f012

SHA1
13e3851f17b2c22cc14dd871d5a75d8744306fee

SHA256
143be3d067188ae89a2c003ef2671bbdd790d6026664078098117cc7fc3373ed

SHA512
98725414e1655542828e207176a67e66d403a9ca5ac1b139a70cd7fe72fb1f8d9740c0c06071edccfb985231448175da81f8b5c68381ad7e1d12a7ad0acce388

Download Submit
\Users\Public\Videos\1644462859\360.tct
Filesize
253KB

MD5
b6ee97ccbebb6c4d06e1a7a7bb4ee1c8

SHA1
7451e21a49529eb7e42fc5fc03d6980fabc00c44

SHA256
87d3ea42604943d2230cc0b5aea499da41fc7db46d141abf96875692040e4699

SHA512
060d9790e31c71e9e9b3d132088c107a6ae79a707ae3654b4c7e5a9248fd610761c0c40c54f4930d36c0379b490e7bee1be5592da85e4fe4c3f5c4a1a2eddd12

Download Submit
\Users\Public\Videos\1644462859\7zz.exe
Filesize
572KB

MD5
f2ae502d448cfb81a5f40a9368d99b1a

SHA1
f849be86e9e7ced0acd51a68f92992b8090d08a5

SHA256
07ad4b984f288304003b080dd013784685181de4353a0b70a0247f96e535bd56

SHA512
9f3aea471684e22bf9fc045ca0e47a8429fa0b13c188f9c7a51937efa8afcec976761b0c4c95aed7735096fcc2278bbd86b0ab581261a6aff6c694d7bb65e9be

Download Submit
\Users\Public\Videos\1644462859\ojbkcg.exe
Filesize
171KB

MD5
e0923ede0d979012969c62063c74f44d

SHA1
f1dcf61b66745eff17702db4d4e4b6baa23bface

SHA256
8577bcbd02d38bce9601eb43511017b0bbc5176ebc3c48c08c81f755fcf216f4

SHA512
65d0ec789d6bfe423ce2b49c54ed26389bf61d9789cb7d2de857f4f24ab15815207bceedf191446e15fb9b0f3752489b3cda69ae85768a06a01654fa4e5a6d68

Download Submit
memory/1492-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1492-54-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1756-68-0x0000000180000000-0x00000001808AB000-memory.dmp

Filesize
8.7MB

Download
memory/1756-72-0x0000000001F50000-0x00000000027C5000-memory.dmp

Filesize
8.5MB

Download
memory/1756-74-0x000007FEFC501000-0x000007FEFC503000-memory.dmp

Filesize
8KB

Download