Analysis
-
max time kernel
76s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-01-2023 14:16
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
General
-
Target
tmp.exe
-
Size
41KB
-
MD5
9fc2e4d640bbce8bc3fa4a6f0f01984d
-
SHA1
52c52532478b1f07e9c74dcd3923a0f23d24406a
-
SHA256
d0b7c72da05449ada1b7a75b481989922f634b33e5bc1648b837698853abb8f5
-
SHA512
533bbbeafb0714a5781056d416b61446f7c2075b0d2e5286a96c00393d4499e95dd48853615b4918aba8b95aa0c0e7849a12a521a0f7d202661b39c9e385c4c4
-
SSDEEP
768:Af/0u9flwYtttWtYtYBtYtxqGGGGGGGGHGGGGGGGGGGGGGGGGGGGGGGGGGGGGUut:E3uGGGGGGGGHGGGGGGGGGGGGGGGGGGG
Malware Config
Extracted
purecrypter
http://163.123.142.210/Cjhgcjqheh.png
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2012-55-0x000000001C4C0000-0x000000001C95E000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
XMRig Miner payload 15 IoCs
Processes:
resource yara_rule behavioral1/memory/952-82-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/952-84-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/952-86-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/952-87-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/952-88-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/952-90-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/952-92-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/952-93-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/952-94-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/952-96-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/952-97-0x000000014036EAC4-mapping.dmp xmrig behavioral1/memory/952-99-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/952-108-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/680-122-0x000000014036EAC4-mapping.dmp xmrig behavioral1/memory/680-126-0x0000000140000000-0x0000000140809000-memory.dmp xmrig -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\setup-update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Winscp\\setup-update.exe\"" tmp.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exeMSBuild.exedescription pid process target process PID 2012 set thread context of 604 2012 tmp.exe MSBuild.exe PID 604 set thread context of 952 604 MSBuild.exe explorer.exe PID 604 set thread context of 680 604 MSBuild.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1552 powershell.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 464 464 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
tmp.exepowershell.exeexplorer.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2012 tmp.exe Token: SeDebugPrivilege 1552 powershell.exe Token: SeLockMemoryPrivilege 952 explorer.exe Token: SeLockMemoryPrivilege 952 explorer.exe Token: SeLockMemoryPrivilege 680 explorer.exe Token: SeLockMemoryPrivilege 680 explorer.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
explorer.exeexplorer.exepid process 952 explorer.exe 952 explorer.exe 952 explorer.exe 680 explorer.exe 680 explorer.exe 952 explorer.exe 680 explorer.exe 952 explorer.exe 680 explorer.exe 952 explorer.exe -
Suspicious use of SendNotifyMessage 10 IoCs
Processes:
explorer.exeexplorer.exepid process 952 explorer.exe 952 explorer.exe 952 explorer.exe 680 explorer.exe 680 explorer.exe 952 explorer.exe 680 explorer.exe 952 explorer.exe 680 explorer.exe 952 explorer.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
tmp.exeMSBuild.exedescription pid process target process PID 2012 wrote to memory of 1552 2012 tmp.exe powershell.exe PID 2012 wrote to memory of 1552 2012 tmp.exe powershell.exe PID 2012 wrote to memory of 1552 2012 tmp.exe powershell.exe PID 2012 wrote to memory of 604 2012 tmp.exe MSBuild.exe PID 2012 wrote to memory of 604 2012 tmp.exe MSBuild.exe PID 2012 wrote to memory of 604 2012 tmp.exe MSBuild.exe PID 2012 wrote to memory of 604 2012 tmp.exe MSBuild.exe PID 2012 wrote to memory of 604 2012 tmp.exe MSBuild.exe PID 2012 wrote to memory of 604 2012 tmp.exe MSBuild.exe PID 2012 wrote to memory of 604 2012 tmp.exe MSBuild.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 952 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe PID 604 wrote to memory of 680 604 MSBuild.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe ehkyzugfc0 6E3sjfZq2rJQaxvLPmXgsGVibFQB1SRFKAJE4g4hvkD3AiVEpf0dgV55vmPVy2HdRPFNj0nba36ZsJAOfcDutlp1uGZD43OinuOsbkrvwsELbcnOwh7z7jTxIxb/8cy9pfSG0diraCsvnytCTdEeT2GKBHsz+86dcPKDL/hWxI5SqjNqMnP2x9Wrll200viFmS5UKRFkzR22xALyEeu9XJQjjuuTyIYvPP4Ev/EE6yU1WvjnM9Sp2EXSRvQOYzWqX5FTSWHt7WGDYd4eL5Zpmre3cqlQsh6wxVtgXUX0aTX41VTxhqK+4nVvT0XXJYih0vuBCgBnmZooDqrF9PUyXXi/imO83AsfsaMeX5t25sVYNxmiIeTvwj02JZ6V2Hi13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\explorer.exeC:\Windows\explorer.exe ehkyzugfc1 6E3sjfZq2rJQaxvLPmXgsJfOyO5DeIKfxGySQHgm1U7SutxdkMUte0IoBcJrwJZR0JxHqq095RdT+1DrfkD2jNApqjcsYyYz/1ffpuXHBMqjauSs2KIzU5jLOKjbNK+Q9aB1MGJaD//u7GHhN5AQFkGNzNZuljbiXjHHftKkwRn0qi9m9L/lrO0mLRvAp4XmpbPCO87NhuLYY+Cnh97Y4yDbiLkUTQmllBLN2kLj5+/iUVOmSRW7K9LvKlQfqGYis+oNYv8jbdSIWTDzRoAjZXcDWJKEZ+qjJ7iMWlp6rShaiUJNh3rtZIbqok5yk6z25MkctmIVhPI10JDyd+35GYmOp0vRfeEAkFtbRaAknpU95kmdqNbBb6GM6x+O2/1G3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/604-67-0x0000000140000000-0x0000000140248000-memory.dmpFilesize
2.3MB
-
memory/604-76-0x0000000000790000-0x0000000000796000-memory.dmpFilesize
24KB
-
memory/604-72-0x0000000140000000-mapping.dmp
-
memory/604-71-0x0000000140000000-0x0000000140248000-memory.dmpFilesize
2.3MB
-
memory/604-70-0x0000000140000000-0x0000000140248000-memory.dmpFilesize
2.3MB
-
memory/604-68-0x0000000140000000-0x0000000140248000-memory.dmpFilesize
2.3MB
-
memory/680-126-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/680-122-0x000000014036EAC4-mapping.dmp
-
memory/952-93-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/952-97-0x000000014036EAC4-mapping.dmp
-
memory/952-128-0x0000000000000000-0x0000000001000000-memory.dmpFilesize
16.0MB
-
memory/952-127-0x0000000000000000-0x0000000001000000-memory.dmpFilesize
16.0MB
-
memory/952-108-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/952-102-0x00000000000E0000-0x0000000000100000-memory.dmpFilesize
128KB
-
memory/952-99-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/952-96-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/952-94-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/952-92-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/952-90-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/952-88-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/952-77-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/952-78-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/952-80-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/952-82-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/952-84-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/952-86-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/952-87-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/1552-56-0x0000000000000000-mapping.dmp
-
memory/1552-64-0x0000000002944000-0x0000000002947000-memory.dmpFilesize
12KB
-
memory/1552-65-0x000000000294B000-0x000000000296A000-memory.dmpFilesize
124KB
-
memory/1552-57-0x000007FEFB5F1000-0x000007FEFB5F3000-memory.dmpFilesize
8KB
-
memory/1552-59-0x000007FEEC0C0000-0x000007FEECAE3000-memory.dmpFilesize
10.1MB
-
memory/1552-60-0x000007FEEB560000-0x000007FEEC0BD000-memory.dmpFilesize
11.4MB
-
memory/1552-63-0x000000000294B000-0x000000000296A000-memory.dmpFilesize
124KB
-
memory/1552-62-0x0000000002944000-0x0000000002947000-memory.dmpFilesize
12KB
-
memory/1552-61-0x000000001B800000-0x000000001BAFF000-memory.dmpFilesize
3.0MB
-
memory/2012-54-0x000000013FA10000-0x000000013FA1E000-memory.dmpFilesize
56KB
-
memory/2012-66-0x000000001B960000-0x000000001BBE2000-memory.dmpFilesize
2.5MB
-
memory/2012-55-0x000000001C4C0000-0x000000001C95E000-memory.dmpFilesize
4.6MB
-
memory/2012-58-0x000000001AF07000-0x000000001AF26000-memory.dmpFilesize
124KB
-
memory/2012-74-0x000000001AF07000-0x000000001AF26000-memory.dmpFilesize
124KB