Analysis
-
max time kernel
128s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
23-01-2023 13:57
General
-
Target
5585edaa1cdcb7c6b2d57f38dc1c35cfbf44e843f681511dc87f3fd61416ab4e.exe
-
Size
10.0MB
-
MD5
0c53e355d7115d9ffce8fd6e821f549d
-
SHA1
438aae0301da7b76e4369f5aec82443d4697815c
-
SHA256
5585edaa1cdcb7c6b2d57f38dc1c35cfbf44e843f681511dc87f3fd61416ab4e
-
SHA512
25c24eeb2fa70f2f89a6340949e9c0a77cd68ad1ccd33643ce235c6a6f3a080f48fb429634acd74a55d769b2951efceee86a8e91a4e9c00f869e35ec1f69507a
-
SSDEEP
192:v9rM5fJ9zFmtz3VwLVkCISfjoWL3KLyZZQF2Qr:vNMpJeVwLVkCTfjoWL3KLMw2+
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://espurity.tk/SystemEnv/uploads/newsoftware-update_Darczohr.jpg
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5585edaa1cdcb7c6b2d57f38dc1c35cfbf44e843f681511dc87f3fd61416ab4e.exe"C:\Users\Admin\AppData\Local\Temp\5585edaa1cdcb7c6b2d57f38dc1c35cfbf44e843f681511dc87f3fd61416ab4e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3268-132-0x00000000000F0000-0x00000000000F8000-memory.dmpFilesize
32KB
-
memory/3268-133-0x00000000050B0000-0x0000000005654000-memory.dmpFilesize
5.6MB
-
memory/3268-134-0x0000000004B00000-0x0000000004B92000-memory.dmpFilesize
584KB
-
memory/3268-135-0x0000000004AA0000-0x0000000004AAA000-memory.dmpFilesize
40KB