purecrypter | 9710c717d29c3939520a177dc44aa08d7098b70f3650c37f25f260f677542306

General

Target

d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe
Size

898KB
MD5

efbdd6926c4cb453abc717966d17247b
SHA1

4d5527e2b261b908905c857776cf625b12b3959c
SHA256

d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6
SHA512

d64ebc2141a1924c50589d349914471192a0be23ed436e98ea5a9c6c5c813e6b41b18979ebc6b0ca360042396fc31d656677d283b7b0a6a7bd6ff9e5f536f68b
SSDEEP

6144:2ahOEYGnXi1o+ragfy6QRTsU3S7OZb9a:2icGXko+ragfAoUC7OZ8

Score

10^/10

purecrypter redline 1 discovery downloader infostealer loader persistence spyware stealer

Malware Config

Extracted

Family

purecrypter

C2

https://buffetdetalhes.com/wp-admin/images/css/marina/bo/Vqhpwhiml.dll

Extracted

Family

redline

Botnet

1

C2

45.142.214.214:20301

Attributes

auth_value
9c39d577e04da4bd3bab7c12203f5f07

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Executes dropped EXE 2 IoCs

Processes:

ifmedianov.exeifmedianov.exe

pid process

4184 ifmedianov.exe
3048 ifmedianov.exe

pid	process
4184	ifmedianov.exe
3048	ifmedianov.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ifmedianov.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	ifmedianov.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

ifmedianov.exe

description pid process target process

PID 4184 set thread context of 3048 4184 ifmedianov.exe ifmedianov.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 4184 set thread context of 3048	4184	ifmedianov.exe	ifmedianov.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

powershell.exeifmedianov.exeifmedianov.exe

pid	process
424	powershell.exe
424	powershell.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
4184	ifmedianov.exe
3048	ifmedianov.exe
3048	ifmedianov.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

ifmedianov.exepowershell.exeifmedianov.exe

description pid process

Token: SeDebugPrivilege 4184 ifmedianov.exe
Token: SeDebugPrivilege 424 powershell.exe
Token: SeDebugPrivilege 3048 ifmedianov.exe

description	pid	process
Token: SeDebugPrivilege	4184	ifmedianov.exe
Token: SeDebugPrivilege	424	powershell.exe
Token: SeDebugPrivilege	3048	ifmedianov.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exeifmedianov.exe

description	pid	process	target process
PID 2912 wrote to memory of 4184	2912	d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe	ifmedianov.exe
PID 2912 wrote to memory of 4184	2912	d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe	ifmedianov.exe
PID 2912 wrote to memory of 4184	2912	d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe	ifmedianov.exe
PID 4184 wrote to memory of 424	4184	ifmedianov.exe	powershell.exe
PID 4184 wrote to memory of 424	4184	ifmedianov.exe	powershell.exe
PID 4184 wrote to memory of 424	4184	ifmedianov.exe	powershell.exe
PID 4184 wrote to memory of 3048	4184	ifmedianov.exe	ifmedianov.exe
PID 4184 wrote to memory of 3048	4184	ifmedianov.exe	ifmedianov.exe
PID 4184 wrote to memory of 3048	4184	ifmedianov.exe	ifmedianov.exe
PID 4184 wrote to memory of 3048	4184	ifmedianov.exe	ifmedianov.exe
PID 4184 wrote to memory of 3048	4184	ifmedianov.exe	ifmedianov.exe
PID 4184 wrote to memory of 3048	4184	ifmedianov.exe	ifmedianov.exe
PID 4184 wrote to memory of 3048	4184	ifmedianov.exe	ifmedianov.exe
PID 4184 wrote to memory of 3048	4184	ifmedianov.exe	ifmedianov.exe

C:\Users\Admin\AppData\Local\Temp\d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe
"C:\Users\Admin\AppData\Local\Temp\d56f262888e77a5de910970fdc1fa46fef7fc527da135926e994affa293ebde6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2912

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:424

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ifmedianov.exe.log
Filesize
1KB

MD5
2e49a0dc2cc777cf418322c4466c896e

SHA1
d1c48311da63a8124b58ca948b0d64409e927d2d

SHA256
b6e3216891c905bc01dfa776fb8f50aadd5b51b997551eb32ad5e21a53574041

SHA512
b03923994a5b5b0c8ea0905a19a820eda810ded3687e965ee280641eb6b9dd8bf36ce3984bb04712199fcaffc28cacbbadcc872e12b2bda7f491091aa656156a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
Filesize
362.5MB

MD5
b0c7de14111c40f664432150255e9f86

SHA1
c54bdb6dc8821d820aad092dfd591fd9ec8ecf49

SHA256
09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115

SHA512
fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
Filesize
362.5MB

MD5
b0c7de14111c40f664432150255e9f86

SHA1
c54bdb6dc8821d820aad092dfd591fd9ec8ecf49

SHA256
09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115

SHA512
fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ifmedianov.exe
Filesize
362.5MB

MD5
b0c7de14111c40f664432150255e9f86

SHA1
c54bdb6dc8821d820aad092dfd591fd9ec8ecf49

SHA256
09a3c1c2d0563b828eee982d12fd5d63bc1307baf0fb0f86bf7806708b656115

SHA512
fc32992df5ae257fcf56572bba9170e85b8aa2783990435228515edde5d1a695109f70df6e8de4807f4b7a48c8cb48b4a6884e5523fe70d93ddda9c09c1dabaf

Download Submit
memory/424-146-0x0000000006360000-0x00000000063C6000-memory.dmp

Filesize
408KB

Download
memory/424-149-0x0000000006EA0000-0x0000000006EBA000-memory.dmp

Filesize
104KB

Download
memory/424-148-0x0000000008010000-0x000000000868A000-memory.dmp

Filesize
6.5MB

Download
memory/424-147-0x00000000069A0000-0x00000000069BE000-memory.dmp

Filesize
120KB

Download
memory/424-145-0x00000000062F0000-0x0000000006356000-memory.dmp

Filesize
408KB

Download
memory/424-144-0x0000000005BB0000-0x00000000061D8000-memory.dmp

Filesize
6.2MB

Download
memory/424-142-0x0000000000000000-mapping.dmp

Download
memory/424-143-0x00000000053D0000-0x0000000005406000-memory.dmp

Filesize
216KB

Download
memory/3048-156-0x00000000072D0000-0x00000000072E2000-memory.dmp

Filesize
72KB

Download
memory/3048-155-0x00000000073B0000-0x00000000074BA000-memory.dmp

Filesize
1.0MB

Download
memory/3048-151-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3048-160-0x0000000007B00000-0x0000000007B76000-memory.dmp

Filesize
472KB

Download
memory/3048-159-0x00000000086D0000-0x0000000008BFC000-memory.dmp

Filesize
5.2MB

Download
memory/3048-158-0x0000000007830000-0x00000000079F2000-memory.dmp

Filesize
1.8MB

Download
memory/3048-150-0x0000000000000000-mapping.dmp

Download
memory/3048-154-0x0000000005A20000-0x0000000006038000-memory.dmp

Filesize
6.1MB

Download
memory/3048-157-0x0000000007330000-0x000000000736C000-memory.dmp

Filesize
240KB

Download
memory/4184-137-0x0000000004BA0000-0x0000000004C32000-memory.dmp

Filesize
584KB

Download
memory/4184-136-0x0000000005290000-0x0000000005834000-memory.dmp

Filesize
5.6MB

Download
memory/4184-138-0x0000000004B50000-0x0000000004B5A000-memory.dmp

Filesize
40KB

Download
memory/4184-141-0x0000000006830000-0x0000000006852000-memory.dmp

Filesize
136KB

Download
memory/4184-132-0x0000000000000000-mapping.dmp

Download
memory/4184-140-0x0000000006440000-0x00000000064F2000-memory.dmp

Filesize
712KB

Download
memory/4184-135-0x0000000000180000-0x00000000001A4000-memory.dmp

Filesize
144KB

Download
memory/4184-139-0x0000000006220000-0x0000000006270000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads