purecrypter | 9710c717d29c3939520a177dc44aa08d7098b70f3650c37f25f260f677542306

General

Target

d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe
Size

898KB
MD5

efbdd6926c4cb453abc717966d17247b
SHA1

4d5527e2b261b908905c857776cf625b12b3959c
SHA256

d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6
SHA512

d64ebc2141a1924c50589d349914471192a0be23ed436e98ea5a9c6c5c813e6b41b18979ebc6b0ca360042396fc31d656677d283b7b0a6a7bd6ff9e5f536f68b
SSDEEP

6144:2ahOEYGnXi1o+ragfy6QRTsU3S7OZb9a:2icGXko+ragfAoUC7OZ8

Score

10^/10

purecrypter redline 1 downloader infostealer loader persistence

Malware Config

Extracted

Family

purecrypter

C2

https://buffetdetalhes.com/wp-admin/images/css/marina/bo/Vqhpwhiml.dll

Extracted

Family

redline

Botnet

1

C2

45.142.214.214:20301

Attributes

auth_value
9c39d577e04da4bd3bab7c12203f5f07

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 2 IoCs

pid	Process
1756	ifmedianov.exe
1796	ifmedianov.exe

Loads dropped DLL 1 IoCs

pid	Process
1756	ifmedianov.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 1796	1756	ifmedianov.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1764	powershell.exe
1756	ifmedianov.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	ifmedianov.exe
Token: SeDebugPrivilege	1764	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1756	1972	d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe	28
PID 1972 wrote to memory of 1756	1972	d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe	28
PID 1972 wrote to memory of 1756	1972	d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe	28
PID 1972 wrote to memory of 1756	1972	d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe	28
PID 1756 wrote to memory of 1764	1756	ifmedianov.exe	29
PID 1756 wrote to memory of 1764	1756	ifmedianov.exe	29
PID 1756 wrote to memory of 1764	1756	ifmedianov.exe	29
PID 1756 wrote to memory of 1764	1756	ifmedianov.exe	29
PID 1756 wrote to memory of 1796	1756	ifmedianov.exe	31
PID 1756 wrote to memory of 1796	1756	ifmedianov.exe	31
PID 1756 wrote to memory of 1796	1756	ifmedianov.exe	31
PID 1756 wrote to memory of 1796	1756	ifmedianov.exe	31
PID 1756 wrote to memory of 1796	1756	ifmedianov.exe	31
PID 1756 wrote to memory of 1796	1756	ifmedianov.exe	31
PID 1756 wrote to memory of 1796	1756	ifmedianov.exe	31
PID 1756 wrote to memory of 1796	1756	ifmedianov.exe	31
PID 1756 wrote to memory of 1796	1756	ifmedianov.exe	31

C:\Users\Admin\AppData\Local\Temp\d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe
"C:\Users\Admin\AppData\Local\Temp\d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
    3⤵
    - Executes dropped EXE
    PID:1796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

Filesize
362.5MB

MD5
b0c7de14111c40f664432150255e9f86

SHA1
c54bdb6dc8821d820aad092dfd591fd9ec8ecf49

SHA256
09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115

SHA512
fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

Filesize
362.5MB

MD5
b0c7de14111c40f664432150255e9f86

SHA1
c54bdb6dc8821d820aad092dfd591fd9ec8ecf49

SHA256
09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115

SHA512
fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

Filesize
362.5MB

MD5
b0c7de14111c40f664432150255e9f86

SHA1
c54bdb6dc8821d820aad092dfd591fd9ec8ecf49

SHA256
09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115

SHA512
fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe

Filesize
362.5MB

MD5
b0c7de14111c40f664432150255e9f86

SHA1
c54bdb6dc8821d820aad092dfd591fd9ec8ecf49

SHA256
09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115

SHA512
fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

Download Submit
memory/1756-57-0x0000000000ED0000-0x0000000000EF4000-memory.dmp

Filesize
144KB

Download
memory/1756-58-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1756-59-0x0000000005780000-0x0000000005854000-memory.dmp

Filesize
848KB

Download
memory/1756-60-0x0000000004F60000-0x0000000004FAA000-memory.dmp

Filesize
296KB

Download
memory/1756-61-0x0000000005390000-0x0000000005422000-memory.dmp

Filesize
584KB

Download
memory/1764-65-0x000000006E6B0000-0x000000006EC5B000-memory.dmp

Filesize
5.7MB

Download
memory/1764-66-0x000000006E6B0000-0x000000006EC5B000-memory.dmp

Filesize
5.7MB

Download
memory/1764-64-0x000000006E6B0000-0x000000006EC5B000-memory.dmp

Filesize
5.7MB

Download
memory/1796-68-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1796-69-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1796-73-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1796-80-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1796-78-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1796-74-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1796-71-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads