Analysis
-
max time kernel
39s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-01-2023 14:12
Static task
static1
Behavioral task
behavioral1
Sample
44622abb2bd17b2c4734318dc5de7f6a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
44622abb2bd17b2c4734318dc5de7f6a.exe
Resource
win10v2004-20220901-en
General
-
Target
44622abb2bd17b2c4734318dc5de7f6a.exe
-
Size
2.9MB
-
MD5
44622abb2bd17b2c4734318dc5de7f6a
-
SHA1
c9d2392a4660759b72bda955a76c4ffd198b4383
-
SHA256
c8c503cad1ff92d608501ae76a4e9b6947580cf686d8867e8f060e37c1a1618a
-
SHA512
158f90bc5ab6727a4b0dc63567b1a1375feb4d9e5afe83aa63d0c1c91f11445d04a44f87e34566c513ec221538f4c4c281db323c325fe9a8513ce394465f5784
-
SSDEEP
49152:6aZXhxYiUWQ6ZMPFuqY6hYFJqlveNDhPpg5PvKM6E+mqp1p1KoHzx:jZRyiRQ6ZSuqXhcBNWXKBmqpj1bzx
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1232-55-0x000000001BC90000-0x000000001BF82000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
44622abb2bd17b2c4734318dc5de7f6a.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ntumenbu = "\"C:\\Users\\Admin\\AppData\\Roaming\\Bfkqfsqy\\Ntumenbu.exe\"" 44622abb2bd17b2c4734318dc5de7f6a.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exe44622abb2bd17b2c4734318dc5de7f6a.exepid process 1988 powershell.exe 1232 44622abb2bd17b2c4734318dc5de7f6a.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exe44622abb2bd17b2c4734318dc5de7f6a.exedescription pid process Token: SeDebugPrivilege 1988 powershell.exe Token: SeDebugPrivilege 1232 44622abb2bd17b2c4734318dc5de7f6a.exe Token: SeDebugPrivilege 1232 44622abb2bd17b2c4734318dc5de7f6a.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
44622abb2bd17b2c4734318dc5de7f6a.exedescription pid process target process PID 1232 wrote to memory of 1988 1232 44622abb2bd17b2c4734318dc5de7f6a.exe powershell.exe PID 1232 wrote to memory of 1988 1232 44622abb2bd17b2c4734318dc5de7f6a.exe powershell.exe PID 1232 wrote to memory of 1988 1232 44622abb2bd17b2c4734318dc5de7f6a.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44622abb2bd17b2c4734318dc5de7f6a.exe"C:\Users\Admin\AppData\Local\Temp\44622abb2bd17b2c4734318dc5de7f6a.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1232-69-0x000000001B080000-0x000000001B0D6000-memory.dmpFilesize
344KB
-
memory/1232-67-0x000000001CB80000-0x000000001CC16000-memory.dmpFilesize
600KB
-
memory/1232-74-0x0000000002757000-0x0000000002776000-memory.dmpFilesize
124KB
-
memory/1232-66-0x000000001C350000-0x000000001C426000-memory.dmpFilesize
856KB
-
memory/1232-73-0x000000001CCD0000-0x000000001CD24000-memory.dmpFilesize
336KB
-
memory/1232-59-0x0000000002757000-0x0000000002776000-memory.dmpFilesize
124KB
-
memory/1232-55-0x000000001BC90000-0x000000001BF82000-memory.dmpFilesize
2.9MB
-
memory/1232-72-0x000000001B510000-0x000000001B5AA000-memory.dmpFilesize
616KB
-
memory/1232-71-0x000000001C4D0000-0x000000001C51C000-memory.dmpFilesize
304KB
-
memory/1232-70-0x000000001C0F0000-0x000000001C144000-memory.dmpFilesize
336KB
-
memory/1232-54-0x0000000000080000-0x0000000000372000-memory.dmpFilesize
2.9MB
-
memory/1232-68-0x000000001CC20000-0x000000001CCD4000-memory.dmpFilesize
720KB
-
memory/1988-61-0x00000000026A4000-0x00000000026A7000-memory.dmpFilesize
12KB
-
memory/1988-57-0x000007FEFBE21000-0x000007FEFBE23000-memory.dmpFilesize
8KB
-
memory/1988-58-0x000007FEEC270000-0x000007FEECC93000-memory.dmpFilesize
10.1MB
-
memory/1988-56-0x0000000000000000-mapping.dmp
-
memory/1988-63-0x00000000026AB000-0x00000000026CA000-memory.dmpFilesize
124KB
-
memory/1988-62-0x000000001B7A0000-0x000000001BA9F000-memory.dmpFilesize
3.0MB
-
memory/1988-60-0x000007FEEB710000-0x000007FEEC26D000-memory.dmpFilesize
11.4MB
-
memory/1988-65-0x00000000026AB000-0x00000000026CA000-memory.dmpFilesize
124KB
-
memory/1988-64-0x00000000026A4000-0x00000000026A7000-memory.dmpFilesize
12KB