Analysis
-
max time kernel
94s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2025, 20:36
Static task
static1
Behavioral task
behavioral1
Sample
fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe
Resource
win10v2004-20250313-en
Errors
General
-
Target
fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe
-
Size
4.3MB
-
MD5
fdfb91eb11a2ce0f0ab3cd5afd063ab8
-
SHA1
bbde70e7ffe152db9b30eced983914f809aa039e
-
SHA256
fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980
-
SHA512
6843d0aac2e128181abaa1609ee44d0150c9fede49483b7104e8149271ca7c6d8b62b2fb0146d07210f1c68df862aa9438f1dc7490de421e85973a8c4f0d5a45
-
SSDEEP
49152:HR6OVgFh11rmo6mxQXiDGTMD1TRLjXpWMiI/57aa1u+ENFAoWo2Dqbf:xBgFhf7BxQXGB3XpWHIh1U+EKo2Dqb
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2684-64-0x0000000010000000-0x00000000101B0000-memory.dmp purplefox_rootkit behavioral1/memory/3960-73-0x0000000010000000-0x00000000101B0000-memory.dmp purplefox_rootkit behavioral1/memory/2684-81-0x0000000000400000-0x0000000000591000-memory.dmp purplefox_rootkit behavioral1/memory/3960-84-0x0000000000400000-0x0000000000591000-memory.dmp purplefox_rootkit behavioral1/memory/5124-104-0x0000000000400000-0x0000000000591000-memory.dmp purplefox_rootkit behavioral1/memory/3936-153-0x0000000000400000-0x0000000000591000-memory.dmp purplefox_rootkit behavioral1/memory/3936-167-0x0000000000400000-0x0000000000591000-memory.dmp purplefox_rootkit -
Purplefox family
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys conhost.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" conhost.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe.lnk fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe -
Executes dropped EXE 4 IoCs
pid Process 2684 conhost.exe 3960 conhost.exe 5124 conhost.exe 3936 conhost.exe -
Loads dropped DLL 1 IoCs
pid Process 3880 fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe -
resource yara_rule behavioral1/memory/3880-4-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-11-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-38-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-50-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-51-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-36-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-34-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-30-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-28-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-26-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-32-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3880-6-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/files/0x000800000002418a-62.dat upx behavioral1/memory/2684-63-0x0000000000400000-0x0000000000591000-memory.dmp upx behavioral1/memory/3960-72-0x0000000000400000-0x0000000000591000-memory.dmp upx behavioral1/memory/2684-81-0x0000000000400000-0x0000000000591000-memory.dmp upx behavioral1/memory/5124-85-0x0000000000400000-0x0000000000591000-memory.dmp upx behavioral1/memory/3960-84-0x0000000000400000-0x0000000000591000-memory.dmp upx behavioral1/memory/3880-102-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/5124-104-0x0000000000400000-0x0000000000591000-memory.dmp upx behavioral1/memory/3936-153-0x0000000000400000-0x0000000000591000-memory.dmp upx behavioral1/memory/3936-167-0x0000000000400000-0x0000000000591000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\conhost.exe fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe File opened for modification C:\Windows\conhost.exe fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe File opened for modification C:\Windows\conhost.exe conhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language conhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language conhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language conhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language conhost.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5856 PING.EXE 6056 cmd.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "232" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5856 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3880 fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe 3880 fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 5124 conhost.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2684 conhost.exe Token: SeLoadDriverPrivilege 5124 conhost.exe Token: 33 5124 conhost.exe Token: SeIncBasePriorityPrivilege 5124 conhost.exe Token: SeShutdownPrivilege 3880 fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3880 fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe 3880 fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe 3880 fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe 1908 LogonUI.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3880 wrote to memory of 2684 3880 fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe 88 PID 3880 wrote to memory of 2684 3880 fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe 88 PID 3880 wrote to memory of 2684 3880 fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe 88 PID 2684 wrote to memory of 6056 2684 conhost.exe 91 PID 2684 wrote to memory of 6056 2684 conhost.exe 91 PID 2684 wrote to memory of 6056 2684 conhost.exe 91 PID 3960 wrote to memory of 5124 3960 conhost.exe 92 PID 3960 wrote to memory of 5124 3960 conhost.exe 92 PID 3960 wrote to memory of 5124 3960 conhost.exe 92 PID 6056 wrote to memory of 5856 6056 cmd.exe 94 PID 6056 wrote to memory of 5856 6056 cmd.exe 94 PID 6056 wrote to memory of 5856 6056 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe"C:\Users\Admin\AppData\Local\Temp\fd59a08037ec33788d8925ab2f272af39c4f2c0cb7bbd9960ab51fc8f3ade980.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\conhost.exeC:\Windows\conhost.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Windows\conhost.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5856
-
-
-
-
C:\Windows\conhost.exeC:\Windows\conhost.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\conhost.exeC:\Windows\conhost.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:5124
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3947055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1908
-
C:\Windows\conhost.exeC:\Windows\conhost.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3936
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
501B
MD570826b4f267658bbe48fc85077ee4309
SHA12384609646d64ca6dfde419da80db619eb69700f
SHA2563f5eaab4cadabace51c5493b555ac64652cd2f09eebdf2dd01b02bfcc0bde5ee
SHA51267a56cb7766122355b66964fa840732fcbffdc7ad87cb2b9fc9554f6041737a0b22d12e195a44346a0b705151e4cabfe1e9293650fcf2112e213f8c3b7a513b2
-
Filesize
2.8MB
MD59134ef6a44e4a9cb311e1139e4590812
SHA17ae8250a4afd225dbc8420183116e8af1cf15cfe
SHA25630000de63dd389b0aef61d01cdae2ed38f4bc0e03ca04e585780ca7b55b47662
SHA51277fa1b7ff4dd4d96041b5b0f6df62b4cea39820163d12921af5fff5a959f26078441e6fd5652f7d4b72565a5fe4e217e869efd724d910d531d24637c5cb74ed8
-
Filesize
652KB
MD54f883e7d4d89a581845bc451d7f7a90c
SHA115dd39b9401b946330288a147437af3d9722bdf1
SHA2567c36b489a2fe329398415fd58a73c3b61f8127d4a4ebb002a64d604cfe2d7387
SHA51256e54e4e03f783fddad2b61ace38f7adfec5bcc0f591aeb9004c82eb674daaafc584037f057123789bafbfedc914d01a7d92af685b2239b232668a3ef2e1f61f