purecrypter | d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6

General

Target

file.exe
Size

898KB
MD5

efbdd6926c4cb453abc717966d17247b
SHA1

4d5527e2b261b908905c857776cf625b12b3959c
SHA256

d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6
SHA512

d64ebc2141a1924c50589d349914471192a0be23ed436e98ea5a9c6c5c813e6b41b18979ebc6b0ca360042396fc31d656677d283b7b0a6a7bd6ff9e5f536f68b
SSDEEP

6144:2ahOEYGnXi1o+ragfy6QRTsU3S7OZb9a:2icGXko+ragfAoUC7OZ8

Score

10^/10

purecrypter redline 1 downloader infostealer loader persistence spyware stealer

Malware Config

Extracted

Family

purecrypter

C2

https://buffetdetalhes.com/wp-admin/images/css/marina/bo/Vqhpwhiml.dll

Extracted

Family

redline

Botnet

1

C2

45.142.214.214:20301

Attributes

auth_value
9c39d577e04da4bd3bab7c12203f5f07

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 2 IoCs

Processes:

ifmedianov.exeifmedianov.exe

pid process

872 ifmedianov.exe
1676 ifmedianov.exe
Loads dropped DLL 1 IoCs

Processes:

ifmedianov.exe

pid process

872 ifmedianov.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
872	ifmedianov.exe
1676	ifmedianov.exe

pid	process
872	ifmedianov.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

file.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ifmedianov.exe

description pid process target process

PID 872 set thread context of 1676 872 ifmedianov.exe ifmedianov.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeifmedianov.exeifmedianov.exe

pid process

1852 powershell.exe
872 ifmedianov.exe
1676 ifmedianov.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

ifmedianov.exepowershell.exeifmedianov.exe

description pid process

Token: SeDebugPrivilege 872 ifmedianov.exe
Token: SeDebugPrivilege 1852 powershell.exe
Token: SeDebugPrivilege 1676 ifmedianov.exe

description	pid	process	target process
PID 872 set thread context of 1676	872	ifmedianov.exe	ifmedianov.exe

pid	process
1852	powershell.exe
872	ifmedianov.exe
1676	ifmedianov.exe

description	pid	process
Token: SeDebugPrivilege	872	ifmedianov.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	1676	ifmedianov.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

file.exeifmedianov.exe

description	pid	process	target process
PID 328 wrote to memory of 872	328	file.exe	ifmedianov.exe
PID 328 wrote to memory of 872	328	file.exe	ifmedianov.exe
PID 328 wrote to memory of 872	328	file.exe	ifmedianov.exe
PID 328 wrote to memory of 872	328	file.exe	ifmedianov.exe
PID 872 wrote to memory of 1852	872	ifmedianov.exe	powershell.exe
PID 872 wrote to memory of 1852	872	ifmedianov.exe	powershell.exe
PID 872 wrote to memory of 1852	872	ifmedianov.exe	powershell.exe
PID 872 wrote to memory of 1852	872	ifmedianov.exe	powershell.exe
PID 872 wrote to memory of 1676	872	ifmedianov.exe	ifmedianov.exe
PID 872 wrote to memory of 1676	872	ifmedianov.exe	ifmedianov.exe
PID 872 wrote to memory of 1676	872	ifmedianov.exe	ifmedianov.exe
PID 872 wrote to memory of 1676	872	ifmedianov.exe	ifmedianov.exe
PID 872 wrote to memory of 1676	872	ifmedianov.exe	ifmedianov.exe
PID 872 wrote to memory of 1676	872	ifmedianov.exe	ifmedianov.exe
PID 872 wrote to memory of 1676	872	ifmedianov.exe	ifmedianov.exe
PID 872 wrote to memory of 1676	872	ifmedianov.exe	ifmedianov.exe
PID 872 wrote to memory of 1676	872	ifmedianov.exe	ifmedianov.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:328

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1852

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

Filesize
362.5MB

MD5
b0c7de14111c40f664432150255e9f86

SHA1
c54bdb6dc8821d820aad092dfd591fd9ec8ecf49

SHA256
09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115

SHA512
fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

Filesize
362.5MB

MD5
b0c7de14111c40f664432150255e9f86

SHA1
c54bdb6dc8821d820aad092dfd591fd9ec8ecf49

SHA256
09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115

SHA512
fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

Filesize
362.5MB

MD5
b0c7de14111c40f664432150255e9f86

SHA1
c54bdb6dc8821d820aad092dfd591fd9ec8ecf49

SHA256
09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115

SHA512
fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

Filesize
362.5MB

MD5
b0c7de14111c40f664432150255e9f86

SHA1
c54bdb6dc8821d820aad092dfd591fd9ec8ecf49

SHA256
09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115

SHA512
fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

Download Submit
memory/872-54-0x0000000000000000-mapping.dmp

Download
memory/872-57-0x0000000000250000-0x0000000000274000-memory.dmp

Filesize
144KB

Download
memory/872-58-0x0000000074ED1000-0x0000000074ED3000-memory.dmp

Filesize
8KB

Download
memory/872-59-0x0000000005B40000-0x0000000005C14000-memory.dmp

Filesize
848KB

Download
memory/872-60-0x0000000004D30000-0x0000000004D7A000-memory.dmp

Filesize
296KB

Download
memory/872-61-0x0000000005090000-0x0000000005122000-memory.dmp

Filesize
584KB

Download
memory/1676-73-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1676-68-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1676-71-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1676-69-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1676-75-0x000000000041B5CA-mapping.dmp

Download
memory/1676-74-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1676-78-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1676-80-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1852-66-0x000000006DA20000-0x000000006DFCB000-memory.dmp

Filesize
5.7MB

Download
memory/1852-65-0x000000006DA20000-0x000000006DFCB000-memory.dmp

Filesize
5.7MB

Download
memory/1852-64-0x000000006DA20000-0x000000006DFCB000-memory.dmp

Filesize
5.7MB

Download
memory/1852-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads