purecrypter | c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b

General

Target

c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b.exe
Size

1.3MB
MD5

f1c29ba01377c35e6f920f0aa626eaf5
SHA1

7b2c191bc2d5d549c5e65613f93d59ece1842f02
SHA256

c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b
SHA512

449a9d0ec42f83be09ef7a258f50f3d07728bb9f06361dc4aebdcbcce0ca010a3c894a5d27d98f197d6b4b85be4e3639656ae75a0216e8e169c54717ad2a85f0
SSDEEP

24576:hT+ua8m657w6ZBLmkitKqBCjC0PDgM5AVnipXD1Z+7:hcVV1BCjBG2

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

C2

https://cents-ability.org/loader/uploads/noicon_Ujizjydo.bmp

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Executes dropped EXE 2 IoCs

Processes:

noicon.exeStearler.exe

pid process

460 noicon.exe
1168 Stearler.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

952 powershell.exe
1064 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

noicon.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 460 noicon.exe
Token: SeDebugPrivilege 952 powershell.exe
Token: SeDebugPrivilege 1064 powershell.exe

pid	process
460	noicon.exe
1168	Stearler.exe

pid	process
952	powershell.exe
1064	powershell.exe

description	pid	process
Token: SeDebugPrivilege	460	noicon.exe
Token: SeDebugPrivilege	952	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b.exeStearler.execmd.exe

description	pid	process	target process
PID 624 wrote to memory of 460	624	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b.exe	noicon.exe
PID 624 wrote to memory of 460	624	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b.exe	noicon.exe
PID 624 wrote to memory of 460	624	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b.exe	noicon.exe
PID 624 wrote to memory of 460	624	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b.exe	noicon.exe
PID 624 wrote to memory of 1168	624	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b.exe	Stearler.exe
PID 624 wrote to memory of 1168	624	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b.exe	Stearler.exe
PID 624 wrote to memory of 1168	624	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b.exe	Stearler.exe
PID 624 wrote to memory of 1168	624	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b.exe	Stearler.exe
PID 624 wrote to memory of 576	624	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b.exe	cmd.exe
PID 624 wrote to memory of 576	624	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b.exe	cmd.exe
PID 624 wrote to memory of 576	624	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b.exe	cmd.exe
PID 1168 wrote to memory of 288	1168	Stearler.exe	cmd.exe
PID 1168 wrote to memory of 288	1168	Stearler.exe	cmd.exe
PID 1168 wrote to memory of 288	1168	Stearler.exe	cmd.exe
PID 1168 wrote to memory of 288	1168	Stearler.exe	cmd.exe
PID 288 wrote to memory of 952	288	cmd.exe	powershell.exe
PID 288 wrote to memory of 952	288	cmd.exe	powershell.exe
PID 288 wrote to memory of 952	288	cmd.exe	powershell.exe
PID 288 wrote to memory of 952	288	cmd.exe	powershell.exe
PID 288 wrote to memory of 1064	288	cmd.exe	powershell.exe
PID 288 wrote to memory of 1064	288	cmd.exe	powershell.exe
PID 288 wrote to memory of 1064	288	cmd.exe	powershell.exe
PID 288 wrote to memory of 1064	288	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b.exe
"C:\Users\Admin\AppData\Local\Temp\c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:624

C:\Users\Administrator\Desktop\DROP\noicon.exe
"C:\Users\Administrator\Desktop\DROP\noicon.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:460

C:\Users\Administrator\Desktop\DROP\Stearler.exe
"C:\Users\Administrator\Desktop\DROP\Stearler.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\7zS172A.tmp\Testobfusc.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -ep bypass -w hidden -Command Add-MpPreference -ExclusionExtension ".vbs"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -ep bypass -w hidden -Command Add-MpPreference -ExclusionPath "C:\Users\Public\Downloads"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\system32\cmd.exe
"cmd.exe"
2⤵
PID:576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS172A.tmp\Testobfusc.bat
Filesize
14KB

MD5
40e65da3d99568737a62d30060539f23

SHA1
c5b616eb054a850b019da2d19e42b82575a269c1

SHA256
a9ea79963c53c3756fc752d4a2978a86de6038fc728fabc200bc87cd938406e5

SHA512
ef19c1001097545955c2d4c3de48bcda7633459577cf3f54653ae0c89fea5e61e763645bdcd2027c303522c98a02893df1f7195b3d26d38a808e7cc78a5c325d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
46fd880a2e2393d005384d82190a3a2d

SHA1
bd690cf97f590a517256187be2597286faade65d

SHA256
012668b1abee8653b60c04318046274f87cfcb2f67b950ccb5054dc1e4d72331

SHA512
351270a3c6871a9dcfa760d22aa0b32bf6bccda8332f2053c1ce171e8ef0e8417ea3aeb46d137d3d676de677913cb6eff30b50ecd0a06620e8b9c0812ebbb12d

Download Submit
C:\Users\Administrator\Desktop\DROP\Stearler.exe
Filesize
127KB

MD5
c07c33c5e7c12107f2788280ad31c391

SHA1
8e14f012e98c39d6b20fe14a7532f299e5c001a0

SHA256
389b207183e0ea0fbc4beac9155486c5e6641d20aebd49eeaaa360dde72b7967

SHA512
8109a67532de5e35036680b66e2bdf06aa5067f1e601c4cf46f4c21721dc9dc3b2a65fcb77e01b74fa4246e1121ee058d81e8ec20c71dd8a2d906a73af88b0a1

Download Submit
C:\Users\Administrator\Desktop\DROP\Stearler.exe
Filesize
127KB

MD5
c07c33c5e7c12107f2788280ad31c391

SHA1
8e14f012e98c39d6b20fe14a7532f299e5c001a0

SHA256
389b207183e0ea0fbc4beac9155486c5e6641d20aebd49eeaaa360dde72b7967

SHA512
8109a67532de5e35036680b66e2bdf06aa5067f1e601c4cf46f4c21721dc9dc3b2a65fcb77e01b74fa4246e1121ee058d81e8ec20c71dd8a2d906a73af88b0a1

Download Submit
C:\Users\Administrator\Desktop\DROP\noicon.exe
Filesize
16.0MB

MD5
fdd4cd11d278dab26c2c8551e006c4ed

SHA1
f0ef434d38fa11f8bc38cbc90874ca582867b214

SHA256
80d4414ca76e050007cb39c7fb598e1828ad168bea5725fb5466ee9388d6fa05

SHA512
9333eaba36a12bb0ab260c553bbed6ddb872fc42b05a2cf3552702c298b3d01d653467a00caa1b5232e9a828dce3810e67e08d1f2e245e4356248bf337fb96bb

Download Submit
C:\Users\Administrator\Desktop\DROP\noicon.exe
Filesize
16.0MB

MD5
fdd4cd11d278dab26c2c8551e006c4ed

SHA1
f0ef434d38fa11f8bc38cbc90874ca582867b214

SHA256
80d4414ca76e050007cb39c7fb598e1828ad168bea5725fb5466ee9388d6fa05

SHA512
9333eaba36a12bb0ab260c553bbed6ddb872fc42b05a2cf3552702c298b3d01d653467a00caa1b5232e9a828dce3810e67e08d1f2e245e4356248bf337fb96bb

Download Submit
memory/288-65-0x0000000000000000-mapping.dmp

Download
memory/460-57-0x0000000000000000-mapping.dmp

Download
memory/460-66-0x0000000000990000-0x0000000000998000-memory.dmp

Filesize
32KB

Download
memory/576-64-0x0000000000000000-mapping.dmp

Download
memory/624-54-0x0000000000870000-0x00000000009B8000-memory.dmp

Filesize
1.3MB

Download
memory/624-56-0x000000001A810000-0x000000001A8C0000-memory.dmp

Filesize
704KB

Download
memory/624-55-0x00000000003D0000-0x0000000000414000-memory.dmp

Filesize
272KB

Download
memory/952-68-0x0000000000000000-mapping.dmp

Download
memory/952-71-0x00000000705B0000-0x0000000070B5B000-memory.dmp

Filesize
5.7MB

Download
memory/1064-72-0x0000000000000000-mapping.dmp

Download
memory/1064-75-0x0000000070540000-0x0000000070AEB000-memory.dmp

Filesize
5.7MB

Download
memory/1168-60-0x0000000000000000-mapping.dmp

Download
memory/1168-62-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing