purecrypter | 03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb

Analysis

max time kernel
148s
max time network
125s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
01-02-2023 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
Size

2.7MB
MD5

21605edd439a91f69b7c2584413ae3f5
SHA1

76353ff45df865cee24b8802c2332c8f07590df6
SHA256

03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb
SHA512

df4248687d7a92389a3aab90dd0ccc8ea7236e8b71555bd835c33816a6e27b9a147d10fe693b57a693698c0d7c3fdbd99a3587cbfba08929c0d0fc4f34efb128
SSDEEP

49152:Q61jlIn2e7zgWTSOa7Q4hVBP35NxVg1DHeTz0CTssEORTdQRYdN+1rHzE42i9:Q6FynB7JTSOWBBNxVg1zen0CLEOhdQTl

Score

10^/10

purecrypter remcos nigeria downloader loader rat

Malware Config

Extracted

Family

remcos

Botnet

nigeria

198.46.173.141:50482

198.46.173.141:50484

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-6CYNGG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Detect PureCrypter injector 1 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/5012-159-0x00000000052E0000-0x0000000005590000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe

description	pid	process	target process
PID 5012 set thread context of 4668	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

4100 powershell.exe
4100 powershell.exe
4100 powershell.exe

pid	process
4100	powershell.exe
4100	powershell.exe
4100	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
Token: SeDebugPrivilege	4100	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe

pid process

4668 03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe

pid	process
4668	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe

C:\Users\Admin\AppData\Local\Temp\03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
"C:\Users\Admin\AppData\Local\Temp\03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Users\Admin\AppData\Local\Temp\03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
C:\Users\Admin\AppData\Local\Temp\03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:4668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4100-266-0x0000000009890000-0x00000000098AA000-memory.dmp

Filesize
104KB

Download
memory/4100-254-0x0000000008A20000-0x0000000008A96000-memory.dmp

Filesize
472KB

Download
memory/4100-187-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/4100-188-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/4100-185-0x0000000000000000-mapping.dmp

Download
memory/4100-226-0x0000000007A20000-0x0000000008048000-memory.dmp

Filesize
6.2MB

Download
memory/4100-186-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/4100-245-0x00000000080C0000-0x0000000008126000-memory.dmp

Filesize
408KB

Download
memory/4100-221-0x0000000004F60000-0x0000000004F96000-memory.dmp

Filesize
216KB

Download
memory/4100-265-0x000000000A320000-0x000000000A998000-memory.dmp

Filesize
6.5MB

Download
memory/4100-246-0x0000000008130000-0x0000000008196000-memory.dmp

Filesize
408KB

Download
memory/4100-250-0x0000000008CA0000-0x0000000008CEB000-memory.dmp

Filesize
300KB

Download
memory/4100-249-0x00000000082A0000-0x00000000082BC000-memory.dmp

Filesize
112KB

Download
memory/4668-274-0x0000000000432E48-mapping.dmp

Download
memory/4668-317-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4668-332-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/5012-155-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-164-0x00000000056A0000-0x00000000056C2000-memory.dmp

Filesize
136KB

Download
memory/5012-133-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-134-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-135-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-136-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-137-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-138-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-139-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-140-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-141-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-142-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-143-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-144-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-145-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-146-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-147-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-148-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-149-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-150-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-151-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-152-0x0000000000780000-0x0000000000A32000-memory.dmp

Filesize
2.7MB

Download
memory/5012-153-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-154-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-131-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-156-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-157-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-158-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-159-0x00000000052E0000-0x0000000005590000-memory.dmp

Filesize
2.7MB

Download
memory/5012-160-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-161-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-162-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-163-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-132-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-165-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-166-0x0000000005710000-0x0000000005A60000-memory.dmp

Filesize
3.3MB

Download
memory/5012-167-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-168-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-169-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-170-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-171-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-172-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-173-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-174-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-175-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-176-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-177-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-178-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-179-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-130-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-129-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-128-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-127-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-126-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-125-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-124-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-123-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-180-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-181-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-182-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-183-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-184-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-272-0x0000000005590000-0x0000000005610000-memory.dmp

Filesize
512KB

Download
memory/5012-122-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-121-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download
memory/5012-120-0x00000000779E0000-0x0000000077B6E000-memory.dmp

Filesize
1.6MB

Download

description	pid	process	target process
PID 5012 wrote to memory of 4100	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	powershell.exe
PID 5012 wrote to memory of 4100	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	powershell.exe
PID 5012 wrote to memory of 4100	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	powershell.exe
PID 5012 wrote to memory of 4668	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
PID 5012 wrote to memory of 4668	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
PID 5012 wrote to memory of 4668	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
PID 5012 wrote to memory of 4668	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
PID 5012 wrote to memory of 4668	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
PID 5012 wrote to memory of 4668	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
PID 5012 wrote to memory of 4668	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
PID 5012 wrote to memory of 4668	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
PID 5012 wrote to memory of 4668	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
PID 5012 wrote to memory of 4668	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
PID 5012 wrote to memory of 4668	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe
PID 5012 wrote to memory of 4668	5012	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe	03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb.exe