Overview

overview

10

Static

static

10

184091318b...ea.exe

windows7-x64

10

184091318b...ea.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    158s
  • max time network
    168s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    18-01-2023 21:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    184091318b80f8bf696c909809e543551e76184156a3287a75f64621950053ea.exe

  • Size

    8KB

  • MD5

    76800519fa85686e45b5664d6e6149fe

  • SHA1

    5dbe386d2988153ff633f23549750acb4c517b89

  • SHA256

    184091318b80f8bf696c909809e543551e76184156a3287a75f64621950053ea

  • SHA512

    11882dc0586c5aeb1ebd03e37b0d18f676968fe91fc91fc81d59f4f804fc0612d0681bb265464dc2fbb6e46856adcb3d53cb45d4de16e4ce1a18bbd8190cabae

  • SSDEEP

    192:KccEsE8Q23qI/qpKtQr9WaTWBAPPWVhd:1cEwQ23qI/ej9WaTWBOPW

Score
10/10
purecrypterdownloaderloader

Malware Config

Extracted

Family

purecrypter

C2

http://80.66.75.34/a-Abtiyod.bmp

Signatures

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\184091318b80f8bf696c909809e543551e76184156a3287a75f64621950053ea.exe
    "C:\Users\Admin\AppData\Local\Temp\184091318b80f8bf696c909809e543551e76184156a3287a75f64621950053ea.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1964-54-0x0000000000F00000-0x0000000000F08000-memory.dmp
    Filesize

    32KB

    Download
  • memory/1964-55-0x0000000074D81000-0x0000000074D83000-memory.dmp
    Filesize

    8KB

    Download