Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-12-2024 18:30

General

  • Target

    4f796d84e88afc6fbb94db40ad396e54ae4f9c90189fab78fec42baa56f2141d.exe

  • Size

    3.6MB

  • MD5

    baecee8312e9a67ca151513e41ac84bf

  • SHA1

    efebb50a06185ccf23c4a613c92001a1f0f50bf3

  • SHA256

    4f796d84e88afc6fbb94db40ad396e54ae4f9c90189fab78fec42baa56f2141d

  • SHA512

    57cb8683cbe5463c201e3f604ccc020ba61f22ed992a1b59a91076409408dac7f17443f38327a7641c1c5d6c1869031699933033a78d35ef1147188bf85dae0e

  • SSDEEP

    49152:moRLXMJPb7aa1u+ENFAoWo2DqbfQ1rmo6mxQXiDGTMD1TRLjXpWMiI:DpXMJPb1U+EKo2Dqb07BxQXGB3XpWHI

Malware Config

Signatures

  • Detect PurpleFox Rootkit 5 IoCs

    Detect PurpleFox Rootkit.

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

  • Purplefox family
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f796d84e88afc6fbb94db40ad396e54ae4f9c90189fab78fec42baa56f2141d.exe
    "C:\Users\Admin\AppData\Local\Temp\4f796d84e88afc6fbb94db40ad396e54ae4f9c90189fab78fec42baa56f2141d.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Windows\conhost.exe
      C:\Windows\conhost.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3460
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Windows\conhost.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:5080
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:820
  • C:\Windows\conhost.exe
    C:\Windows\conhost.exe -auto
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1896
    • C:\Windows\conhost.exe
      C:\Windows\conhost.exe -acsi
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: LoadsDriver
      • Suspicious use of AdjustPrivilegeToken
      PID:1144

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    a798370668.e2.luyouxia.net
    conhost.exe
    Remote address:
    8.8.8.8:53
    Request
    a798370668.e2.luyouxia.net
    IN A
    Response
    a798370668.e2.luyouxia.net
    IN CNAME
    e2.luyouxia.net
    e2.luyouxia.net
    IN A
    123.99.198.201
  • flag-us
    DNS
    17.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    197.87.175.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    197.87.175.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    22.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.49.80.91.in-addr.arpa
    IN PTR
    Response
  • 123.99.198.201:21463
    a798370668.e2.luyouxia.net
    conhost.exe
    260 B
    5
  • 123.99.198.201:21463
    a798370668.e2.luyouxia.net
    conhost.exe
    156 B
    3
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    a798370668.e2.luyouxia.net
    dns
    conhost.exe
    72 B
    102 B
    1
    1

    DNS Request

    a798370668.e2.luyouxia.net

    DNS Response

    123.99.198.201

  • 8.8.8.8:53
    17.160.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    17.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    197.87.175.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    197.87.175.4.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    22.49.80.91.in-addr.arpa
    dns
    70 B
    145 B
    1
    1

    DNS Request

    22.49.80.91.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dzHPSocket4C.dll

    Filesize

    2.8MB

    MD5

    9134ef6a44e4a9cb311e1139e4590812

    SHA1

    7ae8250a4afd225dbc8420183116e8af1cf15cfe

    SHA256

    30000de63dd389b0aef61d01cdae2ed38f4bc0e03ca04e585780ca7b55b47662

    SHA512

    77fa1b7ff4dd4d96041b5b0f6df62b4cea39820163d12921af5fff5a959f26078441e6fd5652f7d4b72565a5fe4e217e869efd724d910d531d24637c5cb74ed8

  • C:\Windows\conhost.exe

    Filesize

    652KB

    MD5

    4f883e7d4d89a581845bc451d7f7a90c

    SHA1

    15dd39b9401b946330288a147437af3d9722bdf1

    SHA256

    7c36b489a2fe329398415fd58a73c3b61f8127d4a4ebb002a64d604cfe2d7387

    SHA512

    56e54e4e03f783fddad2b61ace38f7adfec5bcc0f591aeb9004c82eb674daaafc584037f057123789bafbfedc914d01a7d92af685b2239b232668a3ef2e1f61f

  • memory/1144-52-0x0000000000400000-0x0000000000591000-memory.dmp

    Filesize

    1.6MB

  • memory/1896-22-0x0000000000400000-0x0000000000591000-memory.dmp

    Filesize

    1.6MB

  • memory/1896-23-0x0000000010000000-0x00000000101B0000-memory.dmp

    Filesize

    1.7MB

  • memory/1896-34-0x0000000000400000-0x0000000000591000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-12-0x0000000000400000-0x0000000000591000-memory.dmp

    Filesize

    1.6MB

  • memory/3460-14-0x0000000010000000-0x00000000101B0000-memory.dmp

    Filesize

    1.7MB

  • memory/3460-31-0x0000000000400000-0x0000000000591000-memory.dmp

    Filesize

    1.6MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.