Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2022 19:49

General

  • Target

    1d2449e3291700ec55b809c369dd2dc43c903be05d7c8303aad05c5459792b4d.exe

  • Size

    3.8MB

  • MD5

    da0f48bab3f5251e559a956c8aa7fcd8

  • SHA1

    09a7211b9ac593bf4ddbbd25d6bab3814d945fec

  • SHA256

    1d2449e3291700ec55b809c369dd2dc43c903be05d7c8303aad05c5459792b4d

  • SHA512

    fd27fdb3a23139097ab89c6312e4a0df9243f827a3bde20ff4b8d4f7cbfc9b2e2b3076281e770541d67a4ba2445a800f75be7c311d123ef1dda7db48bb115c67

  • SSDEEP

    98304:a1QjVI10ycazKiEDxjp+7Bln0z4OiZrq1DfPHNADtV6v+QKTKK4KKDyK5FZ1EEER:aueSazKcBln0z4O7NADtV6v+

Malware Config

Signatures

  • Detect PurpleFox Rootkit 1 IoCs

    Detect PurpleFox Rootkit.

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d2449e3291700ec55b809c369dd2dc43c903be05d7c8303aad05c5459792b4d.exe
    "C:\Users\Admin\AppData\Local\Temp\1d2449e3291700ec55b809c369dd2dc43c903be05d7c8303aad05c5459792b4d.exe"
    1⤵
      PID:4860

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4860-132-0x0000000010000000-0x000000001003F000-memory.dmp
      Filesize

      252KB