purplefox | a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da

General

Target

a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
Size

3.8MB
MD5

bdaf5d4a000f4b228a9947bbc54a02b2
SHA1

55c634e32af30aaee69cb577a32dc0d822dde9f7
SHA256

a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da
SHA512

65c2b5a0671e85fe63639a95e187eb9f7354dcbbc70e7e6ea4e11d850d8cefd2a2e62b7f10e1eaa81b928395fa47cbc219c6e59ed173f3bd3ff4ae5e4a15dfb0
SSDEEP

98304:a1QjVI10ycazKiEDxjp+7Bln014OiZrq1DfPHNADtV6v+QKTKK4KKDyK5FZ1EEER:aueSazKcBln014O7NADtV6v+

Score

10^/10

purplefox rootkit trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral1/memory/1976-55-0x0000000010000000-0x000000001003F000-memory.dmp	purplefox_rootkit

PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe

description	ioc	process
File opened (read-only)	\??\W:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\E:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\I:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\K:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\O:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\R:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\B:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\F:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\J:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\L:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\T:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\S:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\V:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\X:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\G:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\H:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\M:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\P:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\Q:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\Y:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\N:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\U:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
File opened (read-only)	\??\Z:	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

Processes:

a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe

pid	process
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
1976	a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe

C:\Users\Admin\AppData\Local\Temp\a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe
"C:\Users\Admin\AppData\Local\Temp\a181fab97fcfa5490838395ae04a41f6e254ad0362e222da50eb45e7b4ad22da.exe"
1⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1976

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1976-55-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads