Analysis
-
max time kernel
39s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-01-2023 19:21
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
General
-
Target
tmp.exe
-
Size
2.9MB
-
MD5
44622abb2bd17b2c4734318dc5de7f6a
-
SHA1
c9d2392a4660759b72bda955a76c4ffd198b4383
-
SHA256
c8c503cad1ff92d608501ae76a4e9b6947580cf686d8867e8f060e37c1a1618a
-
SHA512
158f90bc5ab6727a4b0dc63567b1a1375feb4d9e5afe83aa63d0c1c91f11445d04a44f87e34566c513ec221538f4c4c281db323c325fe9a8513ce394465f5784
-
SSDEEP
49152:6aZXhxYiUWQ6ZMPFuqY6hYFJqlveNDhPpg5PvKM6E+mqp1p1KoHzx:jZRyiRQ6ZSuqXhcBNWXKBmqpj1bzx
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/820-55-0x000000001BBC0000-0x000000001BEB2000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ntumenbu = "\"C:\\Users\\Admin\\AppData\\Roaming\\Bfkqfsqy\\Ntumenbu.exe\"" tmp.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exetmp.exepid process 564 powershell.exe 820 tmp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exetmp.exedescription pid process Token: SeDebugPrivilege 564 powershell.exe Token: SeDebugPrivilege 820 tmp.exe Token: SeDebugPrivilege 820 tmp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
tmp.exedescription pid process target process PID 820 wrote to memory of 564 820 tmp.exe powershell.exe PID 820 wrote to memory of 564 820 tmp.exe powershell.exe PID 820 wrote to memory of 564 820 tmp.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/564-64-0x0000000002714000-0x0000000002717000-memory.dmpFilesize
12KB
-
memory/564-63-0x000000000271B000-0x000000000273A000-memory.dmpFilesize
124KB
-
memory/564-57-0x000007FEFB8F1000-0x000007FEFB8F3000-memory.dmpFilesize
8KB
-
memory/564-56-0x0000000000000000-mapping.dmp
-
memory/564-65-0x000000000271B000-0x000000000273A000-memory.dmpFilesize
124KB
-
memory/564-59-0x000007FEEC3B0000-0x000007FEECDD3000-memory.dmpFilesize
10.1MB
-
memory/564-60-0x000007FEEB850000-0x000007FEEC3AD000-memory.dmpFilesize
11.4MB
-
memory/564-61-0x0000000002714000-0x0000000002717000-memory.dmpFilesize
12KB
-
memory/564-62-0x000000001B6E0000-0x000000001B9DF000-memory.dmpFilesize
3.0MB
-
memory/820-58-0x000000001AEF7000-0x000000001AF16000-memory.dmpFilesize
124KB
-
memory/820-66-0x000000001D110000-0x000000001D1E6000-memory.dmpFilesize
856KB
-
memory/820-55-0x000000001BBC0000-0x000000001BEB2000-memory.dmpFilesize
2.9MB
-
memory/820-54-0x00000000008D0000-0x0000000000BC2000-memory.dmpFilesize
2.9MB
-
memory/820-67-0x000000001D710000-0x000000001D7A6000-memory.dmpFilesize
600KB
-
memory/820-68-0x000000001DFD0000-0x000000001E084000-memory.dmpFilesize
720KB
-
memory/820-69-0x000000001CBE0000-0x000000001CC36000-memory.dmpFilesize
344KB
-
memory/820-70-0x000000001C230000-0x000000001C2CA000-memory.dmpFilesize
616KB
-
memory/820-71-0x000000001D1F0000-0x000000001D244000-memory.dmpFilesize
336KB
-
memory/820-72-0x000000001E080000-0x000000001E0CC000-memory.dmpFilesize
304KB
-
memory/820-73-0x000000001E540000-0x000000001E594000-memory.dmpFilesize
336KB
-
memory/820-74-0x000000001AEF7000-0x000000001AF16000-memory.dmpFilesize
124KB