Analysis
-
max time kernel
47s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
13-01-2023 15:00
General
-
Target
PO_JD09220000_Conmetall GmbH & Co.KG.scr.exe
-
Size
44KB
-
MD5
8e2cabf6bf109fb67984d1a6ee32d36e
-
SHA1
5bd0dfa5e39b3e92258969d0e3b97c4e508fa2f0
-
SHA256
98d78baf7a1ceff6ec4f3d2330a30075df9c461d03ceaac23c478112bb333d48
-
SHA512
19e8b995ad8cf1765f91c0131d889bee405ff68b8d9997d9c7d4b539b17d1d04d699274e1e7b8be2ddfd3f705106db25cfedf7eaec438105ea28feb8a36e9159
-
SSDEEP
192:c554hLbqpP60GOMLwU4JCSYx8tfMHHoYYwOJ4eZAEdKdO58rP4Ggi47saXCBeOO+:c55SLbqV5g4G8tUHHojSe7i29JXYamT
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://cesarsoriano.pe/wp-content/uploads/Estfqtbyf.dll
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_JD09220000_Conmetall GmbH & Co.KG.scr.exe"C:\Users\Admin\AppData\Local\Temp\PO_JD09220000_Conmetall GmbH & Co.KG.scr.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
-
Filesize
8KB
-
Filesize
124KB