purecrypter | d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6

General

Target

file.exe
Size

898KB
MD5

efbdd6926c4cb453abc717966d17247b
SHA1

4d5527e2b261b908905c857776cf625b12b3959c
SHA256

d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6
SHA512

d64ebc2141a1924c50589d349914471192a0be23ed436e98ea5a9c6c5c813e6b41b18979ebc6b0ca360042396fc31d656677d283b7b0a6a7bd6ff9e5f536f68b
SSDEEP

6144:2ahOEYGnXi1o+ragfy6QRTsU3S7OZb9a:2icGXko+ragfAoUC7OZ8

Score

10^/10

purecrypter redline 1 downloader infostealer loader persistence

Malware Config

Extracted

Family

purecrypter

C2

https://buffetdetalhes.com/wp-admin/images/css/marina/bo/Vqhpwhiml.dll

Extracted

Family

redline

Botnet

1

C2

45.142.214.214:20301

Attributes

auth_value
9c39d577e04da4bd3bab7c12203f5f07

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 3 IoCs

Processes:

ifmedianov.exeifmedianov.exeifmedianov.exe

pid process

1904 ifmedianov.exe
3572 ifmedianov.exe
4380 ifmedianov.exe

pid	process
1904	ifmedianov.exe
3572	ifmedianov.exe
4380	ifmedianov.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ifmedianov.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	ifmedianov.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

file.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ifmedianov.exe

description pid process target process

PID 1904 set thread context of 4380 1904 ifmedianov.exe ifmedianov.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 1904 set thread context of 4380	1904	ifmedianov.exe	ifmedianov.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

powershell.exeifmedianov.exe

pid	process
2496	powershell.exe
2496	powershell.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe
1904	ifmedianov.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ifmedianov.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1904 ifmedianov.exe
Token: SeDebugPrivilege 2496 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1904	ifmedianov.exe
Token: SeDebugPrivilege	2496	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

file.exeifmedianov.exe

description	pid	process	target process
PID 1676 wrote to memory of 1904	1676	file.exe	ifmedianov.exe
PID 1676 wrote to memory of 1904	1676	file.exe	ifmedianov.exe
PID 1676 wrote to memory of 1904	1676	file.exe	ifmedianov.exe
PID 1904 wrote to memory of 2496	1904	ifmedianov.exe	powershell.exe
PID 1904 wrote to memory of 2496	1904	ifmedianov.exe	powershell.exe
PID 1904 wrote to memory of 2496	1904	ifmedianov.exe	powershell.exe
PID 1904 wrote to memory of 3572	1904	ifmedianov.exe	ifmedianov.exe
PID 1904 wrote to memory of 3572	1904	ifmedianov.exe	ifmedianov.exe
PID 1904 wrote to memory of 3572	1904	ifmedianov.exe	ifmedianov.exe
PID 1904 wrote to memory of 4380	1904	ifmedianov.exe	ifmedianov.exe
PID 1904 wrote to memory of 4380	1904	ifmedianov.exe	ifmedianov.exe
PID 1904 wrote to memory of 4380	1904	ifmedianov.exe	ifmedianov.exe
PID 1904 wrote to memory of 4380	1904	ifmedianov.exe	ifmedianov.exe
PID 1904 wrote to memory of 4380	1904	ifmedianov.exe	ifmedianov.exe
PID 1904 wrote to memory of 4380	1904	ifmedianov.exe	ifmedianov.exe
PID 1904 wrote to memory of 4380	1904	ifmedianov.exe	ifmedianov.exe
PID 1904 wrote to memory of 4380	1904	ifmedianov.exe	ifmedianov.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
3⤵
- Executes dropped EXE
PID:3572

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
3⤵
- Executes dropped EXE
PID:4380

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ifmedianov.exe.log
Filesize
1KB

MD5
2e49a0dc2cc777cf418322c4466c896e

SHA1
d1c48311da63a8124b58ca948b0d64409e927d2d

SHA256
b6e3216891c905bc01dfa776fb8f50aadd5b51b997551eb32ad5e21a53574041

SHA512
b03923994a5b5b0c8ea0905a19a820eda810ded3687e965ee280641eb6b9dd8bf36ce3984bb04712199fcaffc28cacbbadcc872e12b2bda7f491091aa656156a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
Filesize
362.5MB

MD5
b0c7de14111c40f664432150255e9f86

SHA1
c54bdb6dc8821d820aad092dfd591fd9ec8ecf49

SHA256
09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115

SHA512
fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
Filesize
362.5MB

MD5
b0c7de14111c40f664432150255e9f86

SHA1
c54bdb6dc8821d820aad092dfd591fd9ec8ecf49

SHA256
09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115

SHA512
fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
Filesize
235.4MB

MD5
f0d621207b3805f4101ee9eae0f02a1c

SHA1
f9eb653326a93e608e42800cc874a897f5a95ffa

SHA256
613f6ccc32fa32590acf90815597439cded663f951a87891d54d4078b7e37f18

SHA512
b2910373c9fb6c36064bd4461eeb1ab557223c1dd572d8c712a4576074422c9e871e98941cfe100d40eae57e38c3e43a37ffd4a6a11021eabe9485d8ee3c57a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
Filesize
232.7MB

MD5
04a4105ad93a2ea565e46da45793ac6a

SHA1
913926a0c985c7777bbd0e751e9fe3ed2208a0b4

SHA256
49e99ba25608615607d01de6651bc72d5daaf875150aa053b006e83383f4993e

SHA512
3cc837718882849f8f0a568f37917cde7a78b3d443cc47c7c52bcbacd012fd3b919cfca7b89eb3f425ae4936c852870f01618ba1baa1edd9717df83fb9683282

Download Submit
memory/1904-138-0x00000000057B0000-0x00000000057BA000-memory.dmp

Filesize
40KB

Download
memory/1904-137-0x00000000055F0000-0x0000000005682000-memory.dmp

Filesize
584KB

Download
memory/1904-139-0x0000000006C80000-0x0000000006CD0000-memory.dmp

Filesize
320KB

Download
memory/1904-140-0x0000000006EF0000-0x0000000006FA2000-memory.dmp

Filesize
712KB

Download
memory/1904-141-0x00000000072E0000-0x0000000007302000-memory.dmp

Filesize
136KB

Download
memory/1904-136-0x0000000005C60000-0x0000000006204000-memory.dmp

Filesize
5.6MB

Download
memory/1904-135-0x0000000000C30000-0x0000000000C54000-memory.dmp

Filesize
144KB

Download
memory/1904-132-0x0000000000000000-mapping.dmp

Download
memory/2496-144-0x0000000005350000-0x0000000005978000-memory.dmp

Filesize
6.2MB

Download
memory/2496-146-0x0000000005A60000-0x0000000005AC6000-memory.dmp

Filesize
408KB

Download
memory/2496-147-0x00000000060C0000-0x00000000060DE000-memory.dmp

Filesize
120KB

Download
memory/2496-148-0x0000000007700000-0x0000000007D7A000-memory.dmp

Filesize
6.5MB

Download
memory/2496-149-0x00000000065C0000-0x00000000065DA000-memory.dmp

Filesize
104KB

Download
memory/2496-145-0x00000000059F0000-0x0000000005A56000-memory.dmp

Filesize
408KB

Download
memory/2496-143-0x0000000002AF0000-0x0000000002B26000-memory.dmp

Filesize
216KB

Download
memory/2496-142-0x0000000000000000-mapping.dmp

Download
memory/3572-150-0x0000000000000000-mapping.dmp

Download
memory/4380-152-0x0000000000000000-mapping.dmp

Download
memory/4380-153-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads