purecrypter | 25ffdf6075db2fc329aa4f3d2a9047d166fbf07fa8701a1638939b016d5e3abf

Analysis

max time kernel
153s
max time network
160s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31-01-2023 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup_EN_x64/Setup_EN_x64.exe
Size

668.1MB
MD5

c855ebd5e59f490e592b6bc98df70938
SHA1

669be82147efa583d3fde3d0276bc875f8337b3b
SHA256

e8578df32e15e3018c1417f1d6ff2c041a996d3a6a92d1fc96edef2c90e72c22
SHA512

864bc590f6f317cdfbc2fe31b861b7b6eecd8f6bca6751ea1a750f668591e1dc2fdced683dcab2fa65856f3d9e910edcc0cb057b3c450ccfd6c3099f354b22ce
SSDEEP

1536:PI47GyTGCwiSnmQUt0LB16ULs5gUnujkqkSZZZ3gdtibBmbyoYPQSwH:PvGyYiSDnt16f5HnujSUlbMylPA

Score

10^/10

purecrypter downloader loader persistence

Malware Config

Extracted

Family

purecrypter

https://megalinkbj.com.br/images/img/css/www/soul/Bshya.jpeg

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Executes dropped EXE 1 IoCs

Processes:

SETUP_~1.EXE

pid process

1912 SETUP_~1.EXE

pid	process
1912	SETUP_~1.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Setup_EN_x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	Setup_EN_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Setup_EN_x64.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SETUP_~1.EXE

description pid process

Token: SeDebugPrivilege 1912 SETUP_~1.EXE

description	pid	process
Token: SeDebugPrivilege	1912	SETUP_~1.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Setup_EN_x64.exe

description	pid	process	target process
PID 1116 wrote to memory of 1912	1116	Setup_EN_x64.exe	SETUP_~1.EXE
PID 1116 wrote to memory of 1912	1116	Setup_EN_x64.exe	SETUP_~1.EXE
PID 1116 wrote to memory of 1912	1116	Setup_EN_x64.exe	SETUP_~1.EXE
PID 1116 wrote to memory of 1912	1116	Setup_EN_x64.exe	SETUP_~1.EXE
PID 1116 wrote to memory of 1912	1116	Setup_EN_x64.exe	SETUP_~1.EXE
PID 1116 wrote to memory of 1912	1116	Setup_EN_x64.exe	SETUP_~1.EXE
PID 1116 wrote to memory of 1912	1116	Setup_EN_x64.exe	SETUP_~1.EXE

C:\Users\Admin\AppData\Local\Temp\Setup_EN_x64\Setup_EN_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_EN_x64\Setup_EN_x64.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1116

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Filesize
333.8MB

MD5
7ee2d8bdff477a70229b09c79af73064

SHA1
b884e751fd2bbe4b266fc707a2161b5ba02f4c45

SHA256
127775d506236d1d32070c66cc2dbc30bf2c0656ec68dcee676d055d697ad5bf

SHA512
20f74f1d8d8d3edac68febe35f02196483b581d565ab1a136da7c79084f478f53b4c503d308a7e92589cf7bfc92fc4bb510ff75fafbe4878420108611b46e4d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
Filesize
333.8MB

MD5
7ee2d8bdff477a70229b09c79af73064

SHA1
b884e751fd2bbe4b266fc707a2161b5ba02f4c45

SHA256
127775d506236d1d32070c66cc2dbc30bf2c0656ec68dcee676d055d697ad5bf

SHA512
20f74f1d8d8d3edac68febe35f02196483b581d565ab1a136da7c79084f478f53b4c503d308a7e92589cf7bfc92fc4bb510ff75fafbe4878420108611b46e4d6

Download Submit
memory/1912-54-0x0000000000000000-mapping.dmp

Download
memory/1912-57-0x0000000001040000-0x0000000001048000-memory.dmp

Filesize
32KB

Download
memory/1912-58-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download