Overview
overview
10Static
static
infected/F...98.exe
windows7-x64
8infected/F...98.exe
windows10-2004-x64
8infected/I...er.exe
windows7-x64
10infected/I...er.exe
windows10-2004-x64
10infected/R...ed.exe
windows7-x64
10infected/R...ed.exe
windows10-2004-x64
10infected/S...64.exe
windows7-x64
10infected/S...64.exe
windows10-2004-x64
10infected/b...kO.exe
windows7-x64
10infected/b...kO.exe
windows10-2004-x64
10Analysis
-
max time kernel
124s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
15/01/2023, 17:11
Static task
static1
Behavioral task
behavioral1
Sample
infected/Furk Ultra_10298.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
infected/Furk Ultra_10298.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
infected/Installer.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
infected/Installer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
infected/RobloxSynapceX Cracked.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
infected/RobloxSynapceX Cracked.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
infected/Setup x64.exe
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
infected/Setup x64.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
infected/best-setup_FLc4rckO.exe
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
infected/best-setup_FLc4rckO.exe
Resource
win10v2004-20220812-en
General
-
Target
infected/Installer.exe
-
Size
677.9MB
-
MD5
3709aaf7e625bfd4dfef3ceba18ccc4a
-
SHA1
17fcf830d2cf2c4a016fb438cae8bf065cc55b24
-
SHA256
9440450e86e40c1116742e77b3e97ddb5c4d4d149d9c36d0e1e5c156ddb85cd1
-
SHA512
4ea3c2ef3226b7ed9adb966708b70dd79d6295ea603a23f34b6cada7346ce08bb2f95b2ff686ee922060ab387c5a22b34ee082d23f1d69ccf3fc46036c04c000
-
SSDEEP
3072:gahKyd2n31z5vWp1icKAArDZz4N9GhbkENEkYg6Au/TXlbodEgY:gahOCp0yN90vEXgMrXleEd
Malware Config
Extracted
purecrypter
https://falcaoliderfm.com.br/wp-admin/images/css/cover/bo/Jvizg.dll
Extracted
raccoon
8f25ed0aa267992c7856160c3951e20b
http://77.73.133.23/
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 364 dienetwoov.exe 5032 dienetwoov.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation dienetwoov.exe -
Loads dropped DLL 3 IoCs
pid Process 5032 dienetwoov.exe 5032 dienetwoov.exe 5032 dienetwoov.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" Installer.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce Installer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 364 set thread context of 5032 364 dienetwoov.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1180 powershell.exe 1180 powershell.exe 372 powershell.exe 372 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 364 dienetwoov.exe Token: SeDebugPrivilege 1180 powershell.exe Token: SeDebugPrivilege 372 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4460 wrote to memory of 364 4460 Installer.exe 80 PID 4460 wrote to memory of 364 4460 Installer.exe 80 PID 4460 wrote to memory of 364 4460 Installer.exe 80 PID 364 wrote to memory of 1180 364 dienetwoov.exe 89 PID 364 wrote to memory of 1180 364 dienetwoov.exe 89 PID 364 wrote to memory of 1180 364 dienetwoov.exe 89 PID 364 wrote to memory of 1020 364 dienetwoov.exe 92 PID 364 wrote to memory of 1020 364 dienetwoov.exe 92 PID 364 wrote to memory of 1020 364 dienetwoov.exe 92 PID 364 wrote to memory of 5032 364 dienetwoov.exe 94 PID 364 wrote to memory of 5032 364 dienetwoov.exe 94 PID 364 wrote to memory of 5032 364 dienetwoov.exe 94 PID 364 wrote to memory of 5032 364 dienetwoov.exe 94 PID 364 wrote to memory of 5032 364 dienetwoov.exe 94 PID 364 wrote to memory of 5032 364 dienetwoov.exe 94 PID 364 wrote to memory of 5032 364 dienetwoov.exe 94 PID 364 wrote to memory of 5032 364 dienetwoov.exe 94 PID 1020 wrote to memory of 372 1020 cmd.exe 95 PID 1020 wrote to memory of 372 1020 cmd.exe 95 PID 1020 wrote to memory of 372 1020 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\infected\Installer.exe"C:\Users\Admin\AppData\Local\Temp\infected\Installer.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dienetwoov.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dienetwoov.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA3AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==3⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:372
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dienetwoov.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dienetwoov.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5032
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
Filesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
Filesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
Filesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
Filesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
Filesize
16KB
MD58ad6260b5656f92436334157a2a08961
SHA1d1fe686740e0b72d1cfb956673c7293fba05869a
SHA2569c475d6c0f06a27bff2ebf8b3749a4135ae52bf9259029c16c4d3668232bfd80
SHA51265ec7c87e1e9636e7a27a9ba51b6ce3b6b92e4245a2ef504c895818f29cb9486c0f43cb52750c692e17eda6205058cc29eb2d5de742b203b710fdee19d61ae45
-
Filesize
391.0MB
MD5d57db4d9896f6a1b0f72e4503ba94ed0
SHA1e4dc13b4c7ee490bd268e2241f8812cb3e3d5744
SHA2566a320e135997a07575d8433261146653b3b5c6dd71195ba5e0f892d20a85a09d
SHA512ad99c68a7c31df3d26f195e758e76aed1a4a00f4ef4ad25af5812e3be27940a3002428ec21121be54e47f13ec3145b5c46568e83ff98898f8a52aef8884bea52
-
Filesize
391.0MB
MD5d57db4d9896f6a1b0f72e4503ba94ed0
SHA1e4dc13b4c7ee490bd268e2241f8812cb3e3d5744
SHA2566a320e135997a07575d8433261146653b3b5c6dd71195ba5e0f892d20a85a09d
SHA512ad99c68a7c31df3d26f195e758e76aed1a4a00f4ef4ad25af5812e3be27940a3002428ec21121be54e47f13ec3145b5c46568e83ff98898f8a52aef8884bea52
-
Filesize
391.0MB
MD5d57db4d9896f6a1b0f72e4503ba94ed0
SHA1e4dc13b4c7ee490bd268e2241f8812cb3e3d5744
SHA2566a320e135997a07575d8433261146653b3b5c6dd71195ba5e0f892d20a85a09d
SHA512ad99c68a7c31df3d26f195e758e76aed1a4a00f4ef4ad25af5812e3be27940a3002428ec21121be54e47f13ec3145b5c46568e83ff98898f8a52aef8884bea52