Analysis
-
max time kernel
56s -
max time network
85s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-01-2023 14:16
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
General
-
Target
tmp.exe
-
Size
41KB
-
MD5
9fc2e4d640bbce8bc3fa4a6f0f01984d
-
SHA1
52c52532478b1f07e9c74dcd3923a0f23d24406a
-
SHA256
d0b7c72da05449ada1b7a75b481989922f634b33e5bc1648b837698853abb8f5
-
SHA512
533bbbeafb0714a5781056d416b61446f7c2075b0d2e5286a96c00393d4499e95dd48853615b4918aba8b95aa0c0e7849a12a521a0f7d202661b39c9e385c4c4
-
SSDEEP
768:Af/0u9flwYtttWtYtYBtYtxqGGGGGGGGHGGGGGGGGGGGGGGGGGGGGGGGGGGGGUut:E3uGGGGGGGGHGGGGGGGGGGGGGGGGGGG
Malware Config
Extracted
purecrypter
http://163.123.142.210/Cjhgcjqheh.png
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
XMRig Miner payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/3108-146-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/3108-147-0x000000014036EAC4-mapping.dmp xmrig behavioral2/memory/3108-149-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/2460-152-0x000000014036EAC4-mapping.dmp xmrig behavioral2/memory/2460-153-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/3108-154-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/2460-155-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/3108-148-0x0000000140000000-0x0000000140809000-memory.dmp xmrig -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setup-update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Winscp\\setup-update.exe\"" tmp.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exeMSBuild.exedescription pid process target process PID 5048 set thread context of 3572 5048 tmp.exe MSBuild.exe PID 3572 set thread context of 3108 3572 MSBuild.exe explorer.exe PID 3572 set thread context of 2460 3572 MSBuild.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 928 powershell.exe 928 powershell.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 652 652 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
tmp.exepowershell.exeexplorer.exeexplorer.exedescription pid process Token: SeDebugPrivilege 5048 tmp.exe Token: SeDebugPrivilege 928 powershell.exe Token: SeLockMemoryPrivilege 3108 explorer.exe Token: SeLockMemoryPrivilege 3108 explorer.exe Token: SeLockMemoryPrivilege 2460 explorer.exe Token: SeLockMemoryPrivilege 2460 explorer.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
tmp.exeMSBuild.exedescription pid process target process PID 5048 wrote to memory of 928 5048 tmp.exe powershell.exe PID 5048 wrote to memory of 928 5048 tmp.exe powershell.exe PID 5048 wrote to memory of 3572 5048 tmp.exe MSBuild.exe PID 5048 wrote to memory of 3572 5048 tmp.exe MSBuild.exe PID 5048 wrote to memory of 3572 5048 tmp.exe MSBuild.exe PID 5048 wrote to memory of 3572 5048 tmp.exe MSBuild.exe PID 5048 wrote to memory of 3572 5048 tmp.exe MSBuild.exe PID 5048 wrote to memory of 3572 5048 tmp.exe MSBuild.exe PID 3572 wrote to memory of 3108 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 3108 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 3108 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 3108 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 3108 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 3108 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 3108 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 3108 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 3108 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 3108 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 3108 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 3108 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 3108 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 3108 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 3108 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 2460 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 2460 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 2460 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 2460 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 2460 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 2460 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 2460 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 2460 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 2460 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 2460 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 2460 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 2460 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 2460 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 2460 3572 MSBuild.exe explorer.exe PID 3572 wrote to memory of 2460 3572 MSBuild.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe ehkyzugfc0 6E3sjfZq2rJQaxvLPmXgsGVibFQB1SRFKAJE4g4hvkD3AiVEpf0dgV55vmPVy2HdRPFNj0nba36ZsJAOfcDutlp1uGZD43OinuOsbkrvwsELbcnOwh7z7jTxIxb/8cy9pfSG0diraCsvnytCTdEeT2GKBHsz+86dcPKDL/hWxI5SqjNqMnP2x9Wrll200viFmS5UKRFkzR22xALyEeu9XJQjjuuTyIYvPP4Ev/EE6yU1WvjnM9Sp2EXSRvQOYzWqX5FTSWHt7WGDYd4eL5Zpmre3cqlQsh6wxVtgXUX0aTX41VTxhqK+4nVvT0XXJYih0vuBCgBnmZooDqrF9PUyXXi/imO83AsfsaMeX5t25sVYNxmiIeTvwj02JZ6V2Hi13⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeC:\Windows\explorer.exe ehkyzugfc1 6E3sjfZq2rJQaxvLPmXgsJfOyO5DeIKfxGySQHgm1U7SutxdkMUte0IoBcJrwJZR0JxHqq095RdT+1DrfkD2jNApqjcsYyYz/1ffpuXHBMqjauSs2KIzU5jLOKjbNK+Q9aB1MGJaD//u7GHhN5AQFkGNzNZuljbiXjHHftKkwRn0qi9m9L/lrO0mLRvAp4XmpbPCO87NhuLYY+Cnh97Y4yDbiLkUTQmllBLN2kLj5+/iUVOmSRW7K9LvKlQfqGYis+oNYv8jbdSIWTDzRoAjZXcDWJKEZ+qjJ7iMWlp6rShaiUJNh3rtZIbqok5yk6z25MkctmIVhPI10JDyd+35GYmOp0vRfeEAkFtbRaAknpU95kmdqNbBb6GM6x+O2/1G3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/928-136-0x00007FFD0AAC0000-0x00007FFD0B581000-memory.dmpFilesize
10.8MB
-
memory/928-139-0x00007FFD0AAC0000-0x00007FFD0B581000-memory.dmpFilesize
10.8MB
-
memory/928-138-0x00007FFD0AAC0000-0x00007FFD0B581000-memory.dmpFilesize
10.8MB
-
memory/928-135-0x0000000000000000-mapping.dmp
-
memory/2460-152-0x000000014036EAC4-mapping.dmp
-
memory/2460-153-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/2460-158-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/2460-155-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/3108-154-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/3108-146-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/3108-148-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/3108-151-0x0000000000CD0000-0x0000000000CF0000-memory.dmpFilesize
128KB
-
memory/3108-149-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/3108-147-0x000000014036EAC4-mapping.dmp
-
memory/3572-145-0x000001C3F6760000-0x000001C3F6772000-memory.dmpFilesize
72KB
-
memory/3572-141-0x0000000140000000-mapping.dmp
-
memory/3572-144-0x00007FFD0AAC0000-0x00007FFD0B581000-memory.dmpFilesize
10.8MB
-
memory/3572-143-0x00007FFD0AAC0000-0x00007FFD0B581000-memory.dmpFilesize
10.8MB
-
memory/3572-140-0x0000000140000000-0x0000000140248000-memory.dmpFilesize
2.3MB
-
memory/3572-156-0x00007FFD0AAC0000-0x00007FFD0B581000-memory.dmpFilesize
10.8MB
-
memory/5048-132-0x00000283728F0000-0x00000283728FE000-memory.dmpFilesize
56KB
-
memory/5048-137-0x00007FFD0AAC0000-0x00007FFD0B581000-memory.dmpFilesize
10.8MB
-
memory/5048-133-0x00007FFD0AAC0000-0x00007FFD0B581000-memory.dmpFilesize
10.8MB
-
memory/5048-142-0x00007FFD0AAC0000-0x00007FFD0B581000-memory.dmpFilesize
10.8MB
-
memory/5048-134-0x0000028375E40000-0x0000028375E62000-memory.dmpFilesize
136KB