purecrypter | 127775d506236d1d32070c66cc2dbc30bf2c0656ec68dcee676d055d697ad5bf | Triage

Analysis

max time kernel
152s
max time network
159s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-02-2023 06:36

Sharing

Report Analysis Logs

General

Target

SETUP_~1.exe
Size

333.8MB
MD5

7ee2d8bdff477a70229b09c79af73064
SHA1

b884e751fd2bbe4b266fc707a2161b5ba02f4c45
SHA256

127775d506236d1d32070c66cc2dbc30bf2c0656ec68dcee676d055d697ad5bf
SHA512

20f74f1d8d8d3edac68febe35f02196483b581d565ab1a136da7c79084f478f53b4c503d308a7e92589cf7bfc92fc4bb510ff75fafbe4878420108611b46e4d6
SSDEEP

96:Tpb2e6SIJlQ/XjS4USGpcK0qz0plCGAYW0/9z6t42TFnU:TZsahUSGGKz0pC3M9z6HG

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

C2

https://megalinkbj.com.br/images/img/css/www/soul/Bshya.jpeg

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SETUP_~1.exe

description pid process

Token: SeDebugPrivilege 1016 SETUP_~1.exe

C:\Users\Admin\AppData\Local\Temp\SETUP_~1.exe
"C:\Users\Admin\AppData\Local\Temp\SETUP_~1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-54-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

Filesize
32KB

Download
memory/1016-55-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download