Analysis
-
max time kernel
41s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-01-2023 00:55
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
-
Target
Setup.exe
-
Size
2.5MB
-
MD5
49884eec4a8dcafe6d2993865154cdf4
-
SHA1
8b801c2d83b7602d350734bc3de5de7b9df73436
-
SHA256
d060ee3029a154a6fba6ed666ee5fafb2c8ee019dcfde0819f8aa24392b6e944
-
SHA512
052a2b2706168351060dbd8c725be3cdd4659ee79ea78daaa61674218145ea2e016e8e0100f27aadd0b79ebb46e51d2eca4bc103ca2a4723c50ac7063c745af0
-
SSDEEP
49152:V2+9WCvHTdprm74MntR2XTw5lKX0Zu04iXgIHuxCt8DccbasI:V2p2Td9mVtR2XTol80Zu04iXgHI8DM
Score
10/10
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1292-56-0x0000000005070000-0x00000000052E2000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Setup.exepid process 1292 Setup.exe 1292 Setup.exe 1292 Setup.exe 1292 Setup.exe 1292 Setup.exe 1292 Setup.exe 1292 Setup.exe 1292 Setup.exe 1292 Setup.exe 1292 Setup.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Setup.exedescription pid process Token: SeDebugPrivilege 1292 Setup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Setup.exedescription pid process target process PID 1292 wrote to memory of 1528 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1528 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1528 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1528 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1528 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1528 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1528 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1336 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1336 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1336 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1336 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1336 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1336 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1336 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1360 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1360 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1360 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1360 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1360 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1360 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1360 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1960 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1960 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1960 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1960 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1960 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1960 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1960 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1972 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1972 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1972 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1972 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1972 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1972 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1972 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 984 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 984 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 984 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 984 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 984 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 984 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 984 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 940 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 940 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 940 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 940 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 940 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 940 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 940 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1080 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1080 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1080 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1080 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1080 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1080 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1080 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1084 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1084 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1084 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1084 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1084 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1084 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1084 1292 Setup.exe Setup.exe PID 1292 wrote to memory of 1088 1292 Setup.exe Setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1292-54-0x0000000075E81000-0x0000000075E83000-memory.dmpFilesize
8KB
-
memory/1292-55-0x0000000000060000-0x00000000002EA000-memory.dmpFilesize
2.5MB
-
memory/1292-56-0x0000000005070000-0x00000000052E2000-memory.dmpFilesize
2.4MB
-
memory/1292-57-0x00000000026C0000-0x000000000270C000-memory.dmpFilesize
304KB