purplefox | 608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
16-02-2022 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe
Size

186KB
MD5

2ed8df319374ded66ac933e7b44eb270
SHA1

5f237f5ee1cf93f9860aa3264337727fea796e1d
SHA256

608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff
SHA512

0c1a5e1f7ab3e82d0c304809b488ba48c7d48c175a53480f26c616c69649caa67f937c6a475b3ed117514255d150cbb1f38cd5de1576fd216ebc4d38c7779c80

Score

10^/10

purplefox sainbox loader dropper loader rootkit trojan

Malware Config

Extracted

Family

purplefox

Botnet

Sainbox

45.115.124.71

Extracted

Family

purplefox

Signatures

Detect PurpleFox Dropper 5 IoCs

Detect PurpleFox Dropper.

dropper loader

Processes:

yara_rule
purplefox_dropper
C:\Users\Public\Videos\1645006653\svchost.txt	purplefox_dropper
C:\ProgramData\svchost.txt	purplefox_dropper
behavioral1/memory/3384-142-0x0000000180000000-0x0000000180874000-memory.dmp	purplefox_dropper
behavioral1/memory/3384-147-0x0000000002C40000-0x000000000347E000-memory.dmp	purplefox_dropper

Detect PurpleFox Rootkit 5 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

yara_rule
purplefox_rootkit
C:\Users\Public\Videos\1645006653\svchost.txt	purplefox_rootkit
C:\ProgramData\svchost.txt	purplefox_rootkit
behavioral1/memory/3384-142-0x0000000180000000-0x0000000180874000-memory.dmp	purplefox_rootkit
behavioral1/memory/3384-147-0x0000000002C40000-0x000000000347E000-memory.dmp	purplefox_rootkit

PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Executes dropped EXE 2 IoCs

Processes:

7zz.exeojbkcg.exe

pid process

4568 7zz.exe
3384 ojbkcg.exe

pid	process
4568	7zz.exe
3384	ojbkcg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe

Loads dropped DLL 1 IoCs

Processes:

ojbkcg.exe

pid process

3384 ojbkcg.exe

pid	process
3384	ojbkcg.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ojbkcg.exe

description	ioc	process
File opened (read-only)	\??\J:	ojbkcg.exe
File opened (read-only)	\??\K:	ojbkcg.exe
File opened (read-only)	\??\L:	ojbkcg.exe
File opened (read-only)	\??\P:	ojbkcg.exe
File opened (read-only)	\??\S:	ojbkcg.exe
File opened (read-only)	\??\U:	ojbkcg.exe
File opened (read-only)	\??\E:	ojbkcg.exe
File opened (read-only)	\??\I:	ojbkcg.exe
File opened (read-only)	\??\W:	ojbkcg.exe
File opened (read-only)	\??\Z:	ojbkcg.exe
File opened (read-only)	\??\R:	ojbkcg.exe
File opened (read-only)	\??\F:	ojbkcg.exe
File opened (read-only)	\??\O:	ojbkcg.exe
File opened (read-only)	\??\V:	ojbkcg.exe
File opened (read-only)	\??\G:	ojbkcg.exe
File opened (read-only)	\??\M:	ojbkcg.exe
File opened (read-only)	\??\N:	ojbkcg.exe
File opened (read-only)	\??\Q:	ojbkcg.exe
File opened (read-only)	\??\T:	ojbkcg.exe
File opened (read-only)	\??\X:	ojbkcg.exe
File opened (read-only)	\??\Y:	ojbkcg.exe
File opened (read-only)	\??\B:	ojbkcg.exe
File opened (read-only)	\??\H:	ojbkcg.exe

Drops file in Windows directory 8 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ojbkcg.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ojbkcg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ojbkcg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exeojbkcg.exe

pid	process
2640	608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe
2640	608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe
3384	ojbkcg.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exeTiWorker.exe

description	pid	process
Token: SeShutdownPrivilege	3612	svchost.exe
Token: SeCreatePagefilePrivilege	3612	svchost.exe
Token: SeShutdownPrivilege	3612	svchost.exe
Token: SeCreatePagefilePrivilege	3612	svchost.exe
Token: SeShutdownPrivilege	3612	svchost.exe
Token: SeCreatePagefilePrivilege	3612	svchost.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe
Token: SeRestorePrivilege	3036	TiWorker.exe
Token: SeSecurityPrivilege	3036	TiWorker.exe
Token: SeBackupPrivilege	3036	TiWorker.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe

description	pid	process	target process
PID 2640 wrote to memory of 4568	2640	608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe	7zz.exe
PID 2640 wrote to memory of 4568	2640	608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe	7zz.exe
PID 2640 wrote to memory of 4568	2640	608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe	7zz.exe
PID 2640 wrote to memory of 3384	2640	608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe	ojbkcg.exe
PID 2640 wrote to memory of 3384	2640	608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe	ojbkcg.exe

C:\Users\Admin\AppData\Local\Temp\608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe
"C:\Users\Admin\AppData\Local\Temp\608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640

C:\Users\Public\Videos\1645006653\7zz.exe
"C:\Users\Public\Videos\1645006653\7zz.exe" X -ep2 C:\Users\Public\Videos\1645006653\1.rar C:\Users\Public\Videos\1645006653
2⤵
- Executes dropped EXE
PID:4568

C:\Users\Public\Videos\1645006653\ojbkcg.exe
"C:\Users\Public\Videos\1645006653\ojbkcg.exe" -a
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3612

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svchost.txt
Filesize
8.2MB

MD5
8661e75b667f382c424512e70f229d5d

SHA1
3ebd07281aeef62e4cecc1fadfeb79b55dc626a3

SHA256
c006b7b6196dc366e1c63efec480075dcf2e4c8d6186f0f00b790f95946934d9

SHA512
13485d4f8317ec8ee09175bcdc59fac5d849c19c1b5b72254ba945c499b70cb0dc607b7dd49ed9db44c10ce998396324fadb3355c637b3c7e689cdaef761e577

Download Submit
C:\Users\Public\Videos\1645006653\1.rar
Filesize
2.5MB

MD5
329386fd9857d250ec2274643474758b

SHA1
2e422cd21f4e2ac5ed0144f5126f5a78c8151acb

SHA256
3fffa18db7a9211c0a6e0211bcd3ffe7ae7ef001327dfb29a9af8bf4ba3f2de1

SHA512
0e1774bfe51a2c304e0cd8dab55329bd60e8af2c264557b7029413bc7cbb565a8c8e0ef9382b1f4b00d779c64a54106a969d24aff87e8f71382e131d72b64aa6

Download Submit
C:\Users\Public\Videos\1645006653\360.tct
Filesize
253KB

MD5
b6ee97ccbebb6c4d06e1a7a7bb4ee1c8

SHA1
7451e21a49529eb7e42fc5fc03d6980fabc00c44

SHA256
87d3ea42604943d2230cc0b5aea499da41fc7db46d141abf96875692040e4699

SHA512
060d9790e31c71e9e9b3d132088c107a6ae79a707ae3654b4c7e5a9248fd610761c0c40c54f4930d36c0379b490e7bee1be5592da85e4fe4c3f5c4a1a2eddd12

Download Submit
C:\Users\Public\Videos\1645006653\360.tct
Filesize
253KB

MD5
b6ee97ccbebb6c4d06e1a7a7bb4ee1c8

SHA1
7451e21a49529eb7e42fc5fc03d6980fabc00c44

SHA256
87d3ea42604943d2230cc0b5aea499da41fc7db46d141abf96875692040e4699

SHA512
060d9790e31c71e9e9b3d132088c107a6ae79a707ae3654b4c7e5a9248fd610761c0c40c54f4930d36c0379b490e7bee1be5592da85e4fe4c3f5c4a1a2eddd12

Download Submit
C:\Users\Public\Videos\1645006653\7zz.exe
Filesize
572KB

MD5
f2ae502d448cfb81a5f40a9368d99b1a

SHA1
f849be86e9e7ced0acd51a68f92992b8090d08a5

SHA256
07ad4b984f288304003b080dd013784685181de4353a0b70a0247f96e535bd56

SHA512
9f3aea471684e22bf9fc045ca0e47a8429fa0b13c188f9c7a51937efa8afcec976761b0c4c95aed7735096fcc2278bbd86b0ab581261a6aff6c694d7bb65e9be

Download Submit
C:\Users\Public\Videos\1645006653\ojbkcg.exe
Filesize
171KB

MD5
e0923ede0d979012969c62063c74f44d

SHA1
f1dcf61b66745eff17702db4d4e4b6baa23bface

SHA256
8577bcbd02d38bce9601eb43511017b0bbc5176ebc3c48c08c81f755fcf216f4

SHA512
65d0ec789d6bfe423ce2b49c54ed26389bf61d9789cb7d2de857f4f24ab15815207bceedf191446e15fb9b0f3752489b3cda69ae85768a06a01654fa4e5a6d68

Download Submit
C:\Users\Public\Videos\1645006653\ojbkcg.exe
Filesize
171KB

MD5
e0923ede0d979012969c62063c74f44d

SHA1
f1dcf61b66745eff17702db4d4e4b6baa23bface

SHA256
8577bcbd02d38bce9601eb43511017b0bbc5176ebc3c48c08c81f755fcf216f4

SHA512
65d0ec789d6bfe423ce2b49c54ed26389bf61d9789cb7d2de857f4f24ab15815207bceedf191446e15fb9b0f3752489b3cda69ae85768a06a01654fa4e5a6d68

Download Submit
C:\Users\Public\Videos\1645006653\rundll3222.exe
Filesize
45KB

MD5
c36bb659f08f046b139c8d1b980bf1ac

SHA1
dd3247b225a8da3161f76055f31cbc5f64a66086

SHA256
405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4

SHA512
3eeae6a3b424fa1709b4443f625ee99fa2d2861661214b868d36bf5a63c0aaac61ad3bdd9c4b18cb9d820ef89653787df812289d31d65415c4dd08fd45d0c73f

Download Submit
C:\Users\Public\Videos\1645006653\svchost.txt
Filesize
8.2MB

MD5
8661e75b667f382c424512e70f229d5d

SHA1
3ebd07281aeef62e4cecc1fadfeb79b55dc626a3

SHA256
c006b7b6196dc366e1c63efec480075dcf2e4c8d6186f0f00b790f95946934d9

SHA512
13485d4f8317ec8ee09175bcdc59fac5d849c19c1b5b72254ba945c499b70cb0dc607b7dd49ed9db44c10ce998396324fadb3355c637b3c7e689cdaef761e577

Download Submit
memory/3384-142-0x0000000180000000-0x0000000180874000-memory.dmp

Filesize
8.5MB

Download
memory/3384-147-0x0000000002C40000-0x000000000347E000-memory.dmp

Filesize
8.2MB

Download
memory/3612-130-0x00000243E5550000-0x00000243E5560000-memory.dmp

Filesize
64KB

Download
memory/3612-132-0x00000243E82D0000-0x00000243E82D4000-memory.dmp

Filesize
16KB

Download
memory/3612-131-0x00000243E5C20000-0x00000243E5C30000-memory.dmp

Filesize
64KB

Download