Overview

overview

10

Static

static

10

PO_JD09220...cr.exe

windows7-x64

10

PO_JD09220...cr.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    47s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    13-01-2023 15:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PO_JD09220000_Conmetall GmbH & Co.KG.scr.exe

  • Size

    44KB

  • MD5

    8e2cabf6bf109fb67984d1a6ee32d36e

  • SHA1

    5bd0dfa5e39b3e92258969d0e3b97c4e508fa2f0

  • SHA256

    98d78baf7a1ceff6ec4f3d2330a30075df9c461d03ceaac23c478112bb333d48

  • SHA512

    19e8b995ad8cf1765f91c0131d889bee405ff68b8d9997d9c7d4b539b17d1d04d699274e1e7b8be2ddfd3f705106db25cfedf7eaec438105ea28feb8a36e9159

  • SSDEEP

    192:c554hLbqpP60GOMLwU4JCSYx8tfMHHoYYwOJ4eZAEdKdO58rP4Ggi47saXCBeOO+:c55SLbqV5g4G8tUHHojSe7i29JXYamT

Score
10/10
purecrypterdownloaderloader

Malware Config

Extracted

Family

purecrypter

C2

https://cesarsoriano.pe/wp-content/uploads/Estfqtbyf.dll

Signatures

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO_JD09220000_Conmetall GmbH & Co.KG.scr.exe
    "C:\Users\Admin\AppData\Local\Temp\PO_JD09220000_Conmetall GmbH & Co.KG.scr.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1224-54-0x000000013F600000-0x000000013F60E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/1224-55-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1224-56-0x0000000000736000-0x0000000000755000-memory.dmp
    Filesize

    124KB

    Download