Overview

overview

10

Static

static

远赴缅....exe

windows7-x64

10

远赴缅....exe

windows10-2004-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-10-2022 05:26

Sharing

Copy URL
Twitter E-mail

General

  • Target

    远赴缅甸打击电信诈骗抓捕现场.exe

  • Size

    533KB

  • MD5

    ac610ad3802c015f9c13710e8302b0aa

  • SHA1

    dab8c7124fe3d99fb375fa81c39f409d0db68436

  • SHA256

    fdfbfc6b003ff682a9b364ff852618c0c6af35e20abd357fb3b875f96581e50c

  • SHA512

    eb80ab03e8c8a5157ef3ade6bfd7ee41d5d71268f72288dc49cbf44aafe284c089a107e3cd63da3ec52b7c4e36dbc07b10f977b0d1ae75903bd51cf89ec34ed2

  • SSDEEP

    12288:0kWXuTQ8OKvpmdFzW9f0OnRwCvTXByFNY:DWXkzJJRwWjB

Score
10/10
purplefoxrootkittrojanupx

Malware Config

Signatures

  • Detect PurpleFox Rootkit 3 IoCs

    Detect PurpleFox Rootkit.

    rootkit
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\远赴缅甸打击电信诈骗抓捕现场.exe
    "C:\Users\Admin\AppData\Local\Temp\远赴缅甸打击电信诈骗抓捕现场.exe"
    Drops file in System32 directory
    PID:3928

Network

MITRE ATT&CK Matrix

Replay Monitor

00:00 00:00

Downloads

  • memory/3928-132-0x0000000010000000-0x00000000101B9000-memory.dmp
    Filesize

    1MB

    Download
  • memory/3928-134-0x0000000010000000-0x00000000101B9000-memory.dmp
    Filesize

    1MB

    Download
  • memory/3928-135-0x0000000010000000-0x00000000101B9000-memory.dmp
    Filesize

    1MB

    Download
  • memory/3928-136-0x0000000010000000-0x00000000101B9000-memory.dmp
    Filesize

    1MB

    Download