c0d94c0006a0eaef4426c9e36fae15f41cac3f00d9454a8286b5840af18e77ed

Resubmissions

18/04/2026, 04:58

260418-fl62aaay6j7

17/04/2026, 21:34

260417-1ext9acs6s7

Analysis

user interaction
yes
max time kernel
68s
max time network
72s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/04/2026, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purble Place.exe
Size 59.1MB
Sample260417-1ext9acs6s
SHA256 c0d94c0006a0eaef4426c9e36fae15f41cac3f00d9454a8286b5840af18e77ed
MD5 e1ccd2c89fd644d4f3ad8c84d16fc2ae
SHA1 0cd1ffd4d4ac3c90c887f30ff4e87bda617680c2
SHA512 eee7db4d0e3907a4eee77d32b05d964cd7fb5ced5a4146f326cca1f609e68804b15f95ff0e3288a6ea75ac2ec1e1feda6301087455cab6e837e86126d8fc7bca
SSDEEP 1572864:DYuymd7IOwIWT4XGfaOvhBgOTvYgq1o+O8z4yeYF7W/PPFTwVg46:DtymtIOwIWTVvvhyOTs1oX82o7g3Ft46
TLSH
T148D7332B64661780F5710B30C8A6753380E5BD08B996E6EAFEDC3E4145BB3D9A07E335
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	Purble Place.exe

Executes dropped EXE 1 IoCs

pid	Process
4772	PurblePlace.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	Purble Place.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Purble Place.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PurblePlace.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 4772	4496	Purble Place.exe	84

C:\Users\Admin\AppData\Local\Temp\Purble Place.exe
"C:\Users\Admin\AppData\Local\Temp\Purble Place.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe
  "C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4772

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PurblePlace.exe

Path C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe
Size 937KB
SHA256 f7cfb608bb472d073c84e4021b2c703d148207098a89a26d313df6ff55a806ff
MD5 affb18e583bb28a40f34fbf6175443a6
SHA1 9eac5549521af8096dd0f8d0bb11016b276bb686
SHA512 9b90deed2d4bd9d1eb188925556876f90267a53b01c72839b94fa4e6b750360bc7bd156a92687e06bece989990be4e15d99acb4fd82dd72a726af14532193c54
SSDEEP 12288:JGVRca5hPsi4POcaOXvPnbVN+XBctngb8MeW7QC:JGga7IaOHxNz+CW7Q
TLSH
T10015E75167F84124F5F77BB12A7A66B04A3BBD62AB34C68F0240715E4D72B908E70B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4496-26-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/4772-25-0x0000000001000000-0x00000000010F2000-memory.dmp