47aacbb580a3e41d976fc1b69aca29037421d33c067b0b4829d88af7bed73d34

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
purrstart-windows-amd64.exe
Size 4.2MB
Sample261027-p2kmnac15s
SHA256 47aacbb580a3e41d976fc1b69aca29037421d33c067b0b4829d88af7bed73d34
MD5 877cd1cc4eee3867a408bb1f4728b391
SHA1 a96ad3de5ddf3844c964ac40c7adbb9ad22f7f46
SHA512 82af4909235639f206ba80c0783c06806a7299d7c9ab3cbd87e1603f92654bb8a7728ffb1eb17e71e1cb78289a8a0c4abae4a73d4954b084dcbcbfe59e72eed7
SSDEEP 98304:5OR9pIfoI9difbNaOB+0a9uERHc1rFHGB:mQgI/yfB5K9YmB
TLSH
T18326BE43FCA309A5C1AE92318EA295427A71BC485F3127DF3A94FB682BB37D07935354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
936	purrstart.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\PurrStart = "\"C:\\Users\\Admin\\AppData\\Local\\PurrStart\\purrstart.exe\" --autostart --delay 2s"	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
3324	reg.exe
928	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5744	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5744	AUDIODG.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 3324	6112	purrstart-windows-amd64.exe	91
PID 6112 wrote to memory of 928	6112	purrstart-windows-amd64.exe	93

C:\Users\Admin\AppData\Local\Temp\purrstart-windows-amd64.exe
"C:\Users\Admin\AppData\Local\Temp\purrstart-windows-amd64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Windows\system32\reg.exe
  reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v PurrStart
  2⤵
  - Modifies registry key
  PID:3324
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v PurrStart /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\PurrStart\purrstart.exe\" --autostart --delay 2s" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:928

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x0000000000000500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Users\Admin\AppData\Local\PurrStart\purrstart.exe
"C:\Users\Admin\AppData\Local\PurrStart\purrstart.exe" --autostart --delay 2s
1⤵
- Executes dropped EXE
PID:936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

purrstart.exe

Path C:\Users\Admin\AppData\Local\PurrStart\purrstart.exe
Size 4.2MB
SHA256 47aacbb580a3e41d976fc1b69aca29037421d33c067b0b4829d88af7bed73d34
MD5 877cd1cc4eee3867a408bb1f4728b391
SHA1 a96ad3de5ddf3844c964ac40c7adbb9ad22f7f46
SHA512 82af4909235639f206ba80c0783c06806a7299d7c9ab3cbd87e1603f92654bb8a7728ffb1eb17e71e1cb78289a8a0c4abae4a73d4954b084dcbcbfe59e72eed7
SSDEEP 98304:5OR9pIfoI9difbNaOB+0a9uERHc1rFHGB:mQgI/yfB5K9YmB
TLSH
T18326BE43FCA309A5C1AE92318EA295427A71BC485F3127DF3A94FB682BB37D07935354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads