Resubmissions
21/06/2026, 03:51
260621-eekzssbs6l421/06/2026, 03:34
260621-d41acact3w621/06/2026, 03:30
260621-d2jvksct2s6Analysis
- user interaction
yes - max time kernel
448s - max time network
451s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/06/2026, 03:34
Behavioral task
behavioral1
Sample
Dragon Ball Z Sagas_RhAO-H7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
900 seconds
Behavioral task
behavioral2
Sample
Dragon Ball Z Sagas_RhAO-H7.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
22 signatures
900 seconds
General
- Target Dragon Ball Z Sagas_RhAO-H7.exe
- Size 13.8MB
- Sample260621-d41acact3w
- SHA256 888bfc44c03e97875fd1e88f56c8c052c94af130803a096114a76e480313f0dc
- MD5 73ba3a923298bec113961f4fc107d3ce
- SHA1 bf29783bb2daa9d8a8f1306153072375d2f5eae7
- SHA512 2f81f5503b9c10d082f3d84d9204ff74d39fe7067e78f5b24f57205a7b659121a6bf82f734c177b2e7a6f23b70101ae08522d64160f0e42a8ace0f0b9ef1321a
- SSDEEP 196608:ij6kU9NYlObEk0Lp2dd/kZzkmxgy9NSW7I7GIXSpINbhiTGIwTh3kC3uDEN9TrSw:ALSN30LpEiSCC9XSpIFwah3RuINhkUJ
- TLSH T1A9E6333FB2A8A13FC5AE0B3109739350593BB765695A8C1E0BF0490DDF6A0611F3B766
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 12 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir Dragon Ball Z Sagas_RhAO-H7.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir Dragon Ball Z Sagas_RhAO-H7.tmp Key opened \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\SOFTWARE\AVG\AV\Dir Dragon Ball Z Sagas_RhAO-H7.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version Dragon Ball Z Sagas_RhAO-H7.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast Dragon Ball Z Sagas_RhAO-H7.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast Dragon Ball Z Sagas_RhAO-H7.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version Dragon Ball Z Sagas_RhAO-H7.tmp Key opened \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\SOFTWARE\AVAST Software\Avast\Version Dragon Ball Z Sagas_RhAO-H7.tmp Key opened \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\SOFTWARE\AVAST Software\Avast Dragon Ball Z Sagas_RhAO-H7.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast Dragon Ball Z Sagas_RhAO-H7.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast Dragon Ball Z Sagas_RhAO-H7.tmp Key opened \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\SOFTWARE\Avast Software\Avast Dragon Ball Z Sagas_RhAO-H7.tmp - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: qbittorrent.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4228 netsh.exe - Drops file in Program Files directory 31 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui Purble Place.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK Purble Place.exe File created C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place Purble Place.exe File created C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\en-US Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\en-US Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe Purble Place.exe File opened for modification C:\Program Files\Microsoft Games Purble Place.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui Purble Place.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\en-US Purble Place.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK Purble Place.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Panther\UnattendGC\setupact.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml UserOOBEBroker.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml UserOOBEBroker.exe - Executes dropped EXE 5 IoCs
pid Process 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 400 qbittorrent.exe 616 PurblePlace.exe 1004 PurblePlace.exe 2044 PurblePlace.exe - Loads dropped DLL 3 IoCs
pid Process 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dragon Ball Z Sagas_RhAO-H7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dragon Ball Z Sagas_RhAO-H7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Purble Place.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qbittorrent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PurblePlace.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FileCoAuth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Purble Place.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Purble Place.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/3100-0-0x0000000000400000-0x00000000004CC000-memory.dmp innosetup behavioral2/memory/3100-15-0x0000000000400000-0x00000000004CC000-memory.dmp innosetup behavioral2/memory/3100-70-0x0000000000400000-0x00000000004CC000-memory.dmp innosetup - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Dragon Ball Z Sagas_RhAO-H7.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ Dragon Ball Z Sagas_RhAO-H7.tmp - Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\magnet\shell\ qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\magnet\shell\ = "open" qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\magnet\shell\open\command\ qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\magnet qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\magnet\shell\open qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\magnet\shell\open\command qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\magnet\Content Type = "application/x-magnet" qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\magnet\URL Protocol qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\magnet\DefaultIcon\ qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\magnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\is-OBBRM.tmp\\qbittorrent.exe\" \"%1\"" qbittorrent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ NOTEPAD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\.torrent\ = "qBittorrent" qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\magnet\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\is-OBBRM.tmp\\qbittorrent.exe\",1" qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\magnet\shell qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\magnet\ qbittorrent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ qbittorrent.exe Key created \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\.torrent\ qbittorrent.exe Set value (str) \REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\magnet\ = "URL:Magnet link" qbittorrent.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2480 NOTEPAD.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 400 qbittorrent.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 2840 Dragon Ball Z Sagas_RhAO-H7.tmp - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 400 qbittorrent.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 400 qbittorrent.exe Token: SeIncBasePriorityPrivilege 400 qbittorrent.exe - Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe - Suspicious use of SendNotifyMessage 42 IoCs
pid Process 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe 400 qbittorrent.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3100 wrote to memory of 2840 3100 Dragon Ball Z Sagas_RhAO-H7.exe 88 PID 2840 wrote to memory of 4228 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 90 PID 2840 wrote to memory of 400 2840 Dragon Ball Z Sagas_RhAO-H7.tmp 92 PID 3560 wrote to memory of 616 3560 Purble Place.exe 102 PID 1456 wrote to memory of 1004 1456 Purble Place.exe 117 PID 1856 wrote to memory of 2044 1856 Purble Place.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dragon Ball Z Sagas_RhAO-H7.exe"C:\Users\Admin\AppData\Local\Temp\Dragon Ball Z Sagas_RhAO-H7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\is-C7E3F.tmp\Dragon Ball Z Sagas_RhAO-H7.tmp"C:\Users\Admin\AppData\Local\Temp\is-C7E3F.tmp\Dragon Ball Z Sagas_RhAO-H7.tmp" /SL5="$50226,13603942,780800,C:\Users\Admin\AppData\Local\Temp\Dragon Ball Z Sagas_RhAO-H7.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\netsh.exe"netsh" firewall add allowedprogramC:\Users\Admin\AppData\Local\Temp\is-OBBRM.tmp\qbittorrent.exe "qBittorrent" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4228
-
-
C:\Users\Admin\AppData\Local\Temp\is-OBBRM.tmp\qbittorrent.exe"C:\Users\Admin\AppData\Local\Temp\is-OBBRM.tmp\qbittorrent.exe" magnet:?xt=urn:btih:BFF18AF5608F9196CF05BF0C1F0B54A18C3F0A773⤵
- Enumerates connected drives
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:400
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1528
-
C:\Users\Admin\Downloads\purble_place\Purble Place.exe"C:\Users\Admin\Downloads\purble_place\Purble Place.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe"C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:616
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\purble_place\readme.txt1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:2480
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
PID:1000
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:3572
-
C:\Users\Admin\Downloads\purble_place\Purble Place.exe"C:\Users\Admin\Downloads\purble_place\Purble Place.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe"C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe"2⤵
- Executes dropped EXE
PID:1004
-
-
C:\Users\Admin\Downloads\purble_place\Purble Place.exe"C:\Users\Admin\Downloads\purble_place\Purble Place.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe"C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe"2⤵
- Executes dropped EXE
PID:2044
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK
- Size 847KB
- SHA256 faf049982d19c3afd6508ba80cebe68fa4d05c3990c373e097a366ea9a2e31b2
- MD5 efc4bb0840997e4698487b304109dd70
- SHA1 2e19cbc21b30f8024fa01f5de9646ea453f1f010
- SHA512 92784946e147da601c01100eaebdd7377fae506b2bfa9978f4b658790da2cb495e77348e4068a3666030cc9959da05c94318c6d67a6e0daf6430da4aad9c6f4a
- SSDEEP 12288:SGVRca5hPsi4POcaOXvPnbVN+4BcPab8MeW7QC:SGga7IaOHxNUSCW7Q
- TLSH T1C005185266F84124F8F36BB52A7E62B0497BBD625B34C6CF1244319E4E72BD08A31737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK
- Size 847KB
- SHA256 f90abc2244b16c0d1b935d196d177a89f7a96c4b883aeb112ca92aab0dbdf235
- MD5 494a86d3d77407f235899d57f83f7ac4
- SHA1 9d5950c562a3d9698396106a42f0abb1b5a6d9ab
- SHA512 006efe04ee238465b0b82880d0160e20f1fa36d7dbf354de41f99c9b6e69fd1d32a24502866b77500e695496e8a8139a9663e366772e313061b6d8841a080358
- SSDEEP 6144:W0QORncaK2dhdnc2VaC+L/ylBc8GSMMQub8MtfJ5orW7IaKCOkSJU:tRca5hdnbVN+4BcPab8MeW7QC
- TLSH T1CA055A5166F84024F9F36BB55A7E62B0097BBD629B30C6CF1144719E5E32BD08A31B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab
- Size 58.3MB
- SHA256 0bf08132d129a88ac655cd43f7e311c9a0987dee4d72f90eb527df32adaed31b
- MD5 9eb48d33fc5f31ade2957e170b22e8dd
- SHA1 bf62207febceb6474fe8a11458a94cd22fed93b4
- SHA512 fab5618a1b9cf1540131f920003cc6fa92afa130a2e387f7163cc174fc48a9513d90c980993ca0de766ced078c7e8648297d3a4a5091179c56597acade59e6cb
- SSDEEP 1572864:n4G9g5wXDEh64iCb3KqGhoFgHEQzU3B4wLiestsEyxF:n1SwXIh64vxaoFm6Gw2lk
- TLSH T1E2D733C50453F801E26991BEBE93AB043650F97478A9EC47B72DDBB170C26D0C6BB687
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab
- Size 58.3MB
- SHA256 06832ffe3bfc9bfb30b6584d3892f007fe9d75e2aff052d7d3d2498d43253005
- MD5 add571c6d6f9a6b469c0f19e85314b4a
- SHA1 a32163e209aa6affb0ecbb971398253bed5e2dd4
- SHA512 be5450a15dd7689c743afb29ddf7ad66456bbed227101bae04ddf36ade24c563224cfadf5bd3eb225b40ac8b2c5987e77ed1ab41ee2b4c633ce855448073d6f7
- SSDEEP 1572864:Bg5wXDEh64iCb3KqGhoFgHEQzU3B4wLiestsEyxF:BSwXIh64vxaoFm6Gw2lk
- TLSH T1C0D733C50413F801E26591BEBE92AB043A10F974B899EC87B72DDBB170D36D1C5BB687
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe
- Size 937KB
- SHA256 f7cfb608bb472d073c84e4021b2c703d148207098a89a26d313df6ff55a806ff
- MD5 affb18e583bb28a40f34fbf6175443a6
- SHA1 9eac5549521af8096dd0f8d0bb11016b276bb686
- SHA512 9b90deed2d4bd9d1eb188925556876f90267a53b01c72839b94fa4e6b750360bc7bd156a92687e06bece989990be4e15d99acb4fd82dd72a726af14532193c54
- SSDEEP 12288:JGVRca5hPsi4POcaOXvPnbVN+XBctngb8MeW7QC:JGga7IaOHxNz+CW7Q
- TLSH T10015E75167F84124F5F77BB12A7A66B04A3BBD62AB34C68F0240715E4D72B908E70B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui
- Size 96KB
- SHA256 7e757c2e3d4d8dbd434dda0c384ab63fa8de19afce86dce944ab3bbd193b9323
- MD5 e9de8ca0c34bcb637f5f942209f2344e
- SHA1 8c95e4b8f24f5aa8e914c152465ba5f8c9c776ef
- SHA512 61a3f1316fb268ee226eb5bd61d29a2957b5fd07ef559d2b014e2d26c8784d066b35cdbaee8a0e53f45ebb9c564532007203102f479d95ac609617d6eadb238d
- SSDEEP 1536:VjSF3oM1lZ4ZInMn5YMVfzgvQ4Fn/4phdZhZd:YoMF4ZIqRsVgprZ
- TLSH T1A0A3CD51A3F98549F2FB7F752DB506A41A36BC52FC39C74E1200510E8AB2A46EE70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui
- Size 96KB
- SHA256 3a3ed164e42500a1c5b2d0093f0a813d27dc50d038f330cc100a7e70ece2e6e4
- MD5 0a9156c4e3c48ef827980639c4d1e263
- SHA1 9f13a523321c66208e90d45f87fa0cd9b370e111
- SHA512 8a46c1b44c0ea338aff0d2e2d07c34430b67b68b6d27e1adb8cf216b0f0994172ced106a90283f2f0469b5caa40acedf101d45729b823e5179ea55ac507e04ad
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf
- Size 708B
- SHA256 d23ed894d3fc74470e68d017fc627c355c2a70382fa8759cbe8f1bf6603e0191
- MD5 b9be0d07b6bf8d81797e564a44cd2d07
- SHA1 4c91bd5d1dca691f860bb4fbc2e7e57aede36334
- SHA512 ec22fef031c0d0cd4d9e6961a490c739ae248caba8d7a201a67c21d035ef67511ee11cc949ca1d15f5187856b3a3c95bdae52b485d7c3320da30669dd17e4f34
- TLSH T1BF014C063664D557C12D167599E792A297223486FF01174F7A80732DFC752D45F12622
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf
- Size 780B
- SHA256 0d26ee8471899227f6d8f4f6864f10b4fa21e2e82678a107b2852ce09d6b90f3
- MD5 e3ec5048de7e92d68266ea3fa96ecc16
- SHA1 dbdfcf802df63dd3d769236a6ff8018fe08c6a6f
- SHA512 2a753b8fcccb81558589eec5c48ca04b1d2185a3f396a58553d8e84ba164c3631b8cccd077b63d645fa852b834d630c0a08c99af8ab9fe3e7a06c9478dceab8f
- TLSH T1B0017D0B3654D553C29D42759DA386A2C6217CC7FF011B0BB680B37DAD352916F13626
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-C7E3F.tmp\Dragon Ball Z Sagas_RhAO-H7.tmp
- Size 2.9MB
- SHA256 eaa483432e2cae37fcf1350c160b848948f8e512ed085fab67d901bfcd8d5d07
- MD5 392188858aab78d544835de0fe665a04
- SHA1 e2c06e4d926bbecee75887c83b5a9e732b0103b8
- SHA512 0d0d1d1196d705af2a755d054372b45e8540edeb201d2b9ac2d48a08240399314130f3e78e7e962ce708d3da90ed933fa848023f7db9ecaf7fc6ec7979cb05a5
- SSDEEP 49152:nLJwSihjOb6GLb4SKEs3DyOMC2DlUt0+yO3A32ASNTvSP:FwSi0b67zeCzt0+yO3kSW
- TLSH T1F5D54A27F7887D3ED46B0B364A37C690983BB7627A128D575BF0090C8F355942E3EA46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-OBBRM.tmp\Avast_One.png
- Size 42KB
- SHA256 2ddd50ca3bb30387c309b0a627cc14f2820352679caa1d59f0dd35aed9540453
- MD5 faff96fb8080a98bd1def3c4f9cce9c1
- SHA1 466c66dfaed49d93dd7d8a1e42919a4f03613efa
- SHA512 ad87ccc0bcb0115d5e7255935c5bd2b5eeb85b75f46206987d85f0f5e04afce054b0b3cee3d7577039db6ddbff1f0fdfdca657b7877376e4f97c80c5ed7514b7
- SSDEEP 768:53E5YnNz2SLHvDYgWfGHV8L77Yy/oksC+x8+RfWpzrdYnsi2anUpMQb3HGJ2:536Ynl2SLrYHAWHDgEqCSskn0nqA
- TLSH T11613F1B8B8DE416DDDDED6B8FCE66FF564816437CC84D1EA800CB028518E784366636B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-OBBRM.tmp\Opera_new.png
- Size 51KB
- SHA256 3f63f320e919830fb21fff8dbd82509ecc8330c89513163daedb1b7687a0a529
- MD5 958233a25ac0c23fae9451963eca0de5
- SHA1 8801e6dca9e4e4ad1f5b49caa097733877cf2e2e
- SHA512 996177a1a878ca82c1ce02f8937f51285aa9b7c92471fe9c19b41892739e82aaaa7ebcb7f396d6d777da822578b1db1fea893ed55708521e4b8e31a81cacda0b
- SSDEEP 1536:l7LeXprR91MWpD5Ko2ORwQWwyJUcbWb7H:ApzWTo2ORohKPH
- TLSH T1E33302A0B153C51FBA8B5211D2043975776E92F6F860FF4873CA016CAEE5D415B173CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-OBBRM.tmp\WeatherZero.png
- Size 29KB
- SHA256 ab99cdb7d798cb7b7d8517584d546aa4ed54eca1b808de6d076710c8a400c8c4
- MD5 9ac6287111cb2b272561781786c46cdd
- SHA1 6b02f2307ec17d9325523af1d27a6cb386c8f543
- SHA512 f998a4e0ce14b3898a72e0b8a3f7154fc87d2070badcfa98582e3b570ca83a562d5a0c95f999a4b396619db42ab6269a2bac47702597c5a2c37177441723d837
- SSDEEP 768:Fk7fJC9WjOI1DaGmnitN039DODp56Ys+9S/IUM+:FktpB4FiQ3qd9S/BN
- TLSH T188D2D0381BFEE4C6EC67B874148F1F234A2B94BAC0D4E215F801969D1549E5EB58CDA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-OBBRM.tmp\botva2.dll
- Size 37KB
- SHA256 450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
- MD5 67965a5957a61867d661f05ae1f4773e
- SHA1 f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
- SHA512 c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
- SSDEEP 768:kyNq+QWR4gxSUzF08/zFlKcLdQxNld36fJPHw5g4wT1C:jNq+Qw0+JLAqf9Hw5C1C
- TLSH T125034961E9E2D030C096DAFE7D34E224E76F3D201E264AFD5E996ACCDE5BE02141C167
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-OBBRM.tmp\finish.png
- Size 2KB
- SHA256 760b70612bb9bd967c2d15a5133a50ccce8c0bd46a6464d76875298dcc45dea0
- MD5 7afaf9e0e99fd80fa1023a77524f5587
- SHA1 e20c9c27691810b388c73d2ca3e67e109c2b69b6
- SHA512 a090626e7b7f67fb5aa207aae0cf65c3a27e1b85e22c9728eee7475bd9bb7375ca93baaecc662473f9a427b4f505d55f2c61ba36bda460e4e6947fe22eedb044
- TLSH T13D413AF6737D55E94BE6C4308E55D50438B099E70EC08C62FA3752F210A2C4C05D1773
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-OBBRM.tmp\qbittorrent.exe
- Size 22.8MB
- SHA256 3cec1e40e8116a35aac6df3da0356864e5d14bc7687c502c7936ee9b7c1b9c58
- MD5 22a34900ada67ead7e634eb693bd3095
- SHA1 2913c78bcaaa6f4ee22b0977be72333d2077191d
- SHA512 88d90646f047f86adf3d9fc5c04d97649b0e01bac3c973b2477bb0e9a02e97f56665b7ede1800b68edd87115aed6559412c48a79942a8c2a656dfae519e2c36f
- SSDEEP 393216:NKsbm0ApvEqrGtYHviInnmC0dGpZFE6ZFERnsW4j2SDXdfD5X3vcMiWqMDi49QLu:hqr8NInmCgltTSDX59RidMm4uu
- TLSH T14937D022B6438135C6510270892EAB6B83BDFA340BB445D7B3982EEC6E715D33E37657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-OBBRM.tmp\zbShieldUtils.dll
- Size 2.0MB
- SHA256 7d09715c4e0735a0832bf81d92d84600df1815a2ba451586bd25eb16f7c450a5
- MD5 c79e3df659cdee033a447a8f372760ce
- SHA1 f402273e29a6fa39572163e4595e72bde3d9330a
- SHA512 490cc30ccfac209f1f5332ce4168b0dc849d7e4d86f3c198ddd23b39ddc950001928a1e071c2ace74c4710508265c0872adb02e3f068e521d28ed8b19ea36492
- SSDEEP 49152:rLiTeQoehGDyFCdZlc36loEvUZW6IcKZjt5yn4bzfLCs:raRrOyFC/lq6loEvN6IcKFt5ynMz
- TLSH T168958E613556446FF21B12355A3CB669F2BDA3700BF543C73E94EE1839334828E1A6AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vista Games\Purble Place.lnk
- Size 1KB
- SHA256 fb1ce9fdde6929d5d8f55cc59b26e3f5946422ab9f57ab15a6ae00e0d6314a18
- MD5 e0b46587048c4ceec8685578eefaeda5
- SHA1 c50cef77a1b29856501a1308eae7bdf48ff52bcc
- SHA512 3a15f86902ea568a6019de9cecee46a2e44f83ad48e7da4ffbe80c2950eee1c1a75db44654dadd9611eac9813f30849666427f04f918605e9db62a2d6aa24aaa
- TLSH T16C219B0443EA2F5DF37224353D732BF06E23B803EB65871D4289229914F85108E35F67
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vista Games\Purble Place.lnk
- Size 1KB
- SHA256 eebfa0faf534d96e5e8366477f66b4b133fe64bf913dcad6fddd8a13713c9bc6
- MD5 731d5f427e38b754502d7ea7bbc9c27e
- SHA1 f3e86712435b7bdb32458cbbb1c9defad573ad0a
- SHA512 c8a6418eb0d885ab3c39fdcb0108dc1108d3895151508a21ffcd016bc86ac8e4f94152b2b5a93a434899d64e7c3ea6867dee204ce9534eac4846f925017c55ea
- TLSH T1F8217B1403D91F69F37224353D332BF06E33B803EB658B0D4289219918B46508E34F57
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent.ini
- Size 1KB
- SHA256 f05a1303003682657b5fe51aa529532da1698bf5d2382a85e54ac33c2a8aa97a
- MD5 317236f60a152fc91fd6e0657afb4877
- SHA1 eadc1c4384e6d1bd8d4465515bd2002fd54525d4
- SHA512 3a13fc184b40efae1ca37c5262724d744a55c05e888cc67e2320fca2db31db522ad6235bf6d4e3bb73c4815944df6d2b594ca2d304caeb81432e307cb162b0d7
- TLSH T141313E12E705B16AC4CCC3454FF9CB97A2378A0DEA84F00BAD907256EE4C7E45A9CCC8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\qBittorrent\qBittorrent.ini
- Size 2KB
- SHA256 587087859abb61f95ef69d7ecfb05b358c1f95a3df9b216e8dcee2d0f236c5dd
- MD5 b3aab987aff662c77bd98b4dfbde4bbc
- SHA1 206a91280b9d18b68fcbef2c386ca6a0cd4f2536
- SHA512 01cc3c3311aa3f861c3ca30d50c547a01ad02c28e9b9fed5bd7da7178754f7235744e907241e299606da44a2662b5da40cb6a85da3b0959bd5213635c6490446
- TLSH T1EC41EC22D70871AAC4DCC3014FF9C75BA1378A1DE548F00BAD54366AEE4CBE4559CCD5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\qBittorrent\watched_folders.json
- Size 4B
- SHA256 d914176fd50bd7f565700006a31aa97b79d3ad17cee20c8e5ff2061d5cb74817
- MD5 5b76b0eef9af8a2300673e0553f609f9
- SHA1 0b56d40c0630a74abec5398e01c6cd83263feddc
- SHA512 cf06a50de1bf63b7052c19ad53766fa0d99a4d88db76a7cbc672e33276e3d423e4c5f5cb4a8ae188c5c0e17d93bb740eaab6f25753f0d26501c5f84aeded075d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\Purble place\Vista.Emulation.zip
- Size 27KB
- SHA256 e44a9f368d4791bed7a27027fe8940643716bfde51014da6a57ae0748a3caefe
- MD5 117c9036d884faf47d49a7f368bc93e0
- SHA1 a0abd2dc89cd1f7dc28c2d0d5b0948b0bd904c6c
- SHA512 4da63ba9ade987621a375465c4c8b5696dc1610fc865225cacd12cf22749963b6570ca7921b0d59d719666fc45e8063c5c3eeb15f54880763cee4ad76e37d817
- SSDEEP 768:gRem41TVLlIzly0TiEUq9QJxHbHgjJm7IzWcoP:Op4pyYVhqeJp7gjJ3zDoP
- TLSH T18AC2F211DE6CC5308D1C6BFFE353A93CF4A826DC13BC014AD6D6935A514781A3637AB2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Purble place\purble_place.zip
- Size 58.8MB
- SHA256 4f0a75bd3577f191991dc128bdbec49bff416b23975d841cd3c58fe5a42d3eba
- MD5 fb4e3a4556926b294f99ff496fde894b
- SHA1 e367e65641de7a7b0fad13d60da170e6d5855aca
- SHA512 e07eff2a84fd214a4a3b6d919a0404d36bd12ac5f509bb497d4286c4fdc53068ad9c5e8a4ca3f6fa831de5207df8ee08e2f361ca16e81ffb74318238b6d0b0c1
- SSDEEP 24576:Rh3v/tk3LhZWvYqfBWksXsKaKnA+SYUsIqJ/NARThOnylx1+gstIm7i:Llk3LhcvVfBWkrKaKntHv/MTh18gie
- TLSH T125D7337B8EE706D4F4A352B60F3B80562764769CB6586F8DB21C3D11BB1C1CDA71E828
- MD5 SHA1 SHA512 SSDEEP TLSH