Analysis

  • max time kernel
    142s
  • max time network
    166s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    01-02-2023 20:12

General

  • Target

    newsoftware-tester.exe

  • Size

    6KB

  • MD5

    d785e46b0d269b0578dcfd1b90375a6a

  • SHA1

    d1c4a196f24f0659c29fb05e99e690c87bf6d673

  • SHA256

    164df1aecac769eb2d9485abcb776f9ee55fc1e297c5b8b2bc50009e786d41b2

  • SHA512

    ea93bf91f0035a2996f227e04ccca718a9a470ca477e2e5af12a5180c70c62d6efcdbfd29d40e0458baa5ebdd525b5281e342ec29d01fc6fc9173a5b625704c3

  • SSDEEP

    96:673zsN+JBcMAiLt6NkIJmaI8RP4e/kvHxNezNt:oo+MOLtErRJcvb4

Malware Config

Extracted

Family

purecrypter

C2

http://justnormalsite.ddns.net/SystemEnv/uploads/newsoftware-tester_Ilbiekxz.png

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Signatures

  • Detect PureCrypter injector 1 IoCs
  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\newsoftware-tester.exe
    "C:\Users\Admin\AppData\Local\Temp\newsoftware-tester.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig/release
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1076
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /release
        3⤵
        • Gathers network information
        PID:1348
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANQAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:692
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1408
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1036
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig/renew
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1884
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /renew
        3⤵
        • Gathers network information
        PID:1664
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      2⤵
      • Loads dropped DLL
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:1860
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
            PID:644
          • C:\Windows\SysWOW64\netsh.exe
            netsh wlan show profile
            4⤵
              PID:1780
            • C:\Windows\SysWOW64\findstr.exe
              findstr All
              4⤵
                PID:1976
            • C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe
              "C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1756

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Execution

        Command-Line Interface

        1
        T1059

        Defense Evasion

        Install Root Certificate

        1
        T1130

        Modify Registry

        1
        T1112

        Credential Access

        Credentials in Files

        1
        T1081

        Discovery

        System Information Discovery

        3
        T1082

        Query Registry

        1
        T1012

        Collection

        Data from Local System

        1
        T1005

        Email Collection

        1
        T1114

        Command and Control

        Web Service

        1
        T1102

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Tor\libcrypto-1_1.dll
          Filesize

          3.5MB

          MD5

          3406f79392c47a72bed2f0067b3ce466

          SHA1

          a8e2940d61fc840441c4e2a835959d197929ffdf

          SHA256

          e4b6b2ca32b1e2ba26959ec7380c4f117418d3a724f60494ff3cb81505fbf43d

          SHA512

          930d794aa8715dcd23fafbead7fe2ec95d2863783b4c52279870cad93d5b6cf02ba8a13e2653d2bf731e9882bf63f43a7e44788ce47505346be3fe8e8b872fa4

        • C:\Users\Admin\AppData\Local\Temp\Tor\libevent-2-1-7.dll
          Filesize

          1.1MB

          MD5

          a3bf8e33948d94d490d4613441685eee

          SHA1

          75ed7f6e2855a497f45b15270c3ad4aed6ad02e2

          SHA256

          91c812a33871e40b264761f1418e37ebfeb750fe61ca00cbcbe9f3769a8bf585

          SHA512

          c20ef2efcacb5f8c7e2464de7fde68bf610ab2e0608ff4daed9bf676996375db99bee7e3f26c5bd6cca63f9b2d889ed5460ec25004130887cd1a90b892be2b28

        • C:\Users\Admin\AppData\Local\Temp\Tor\libgcc_s_sjlj-1.dll
          Filesize

          1.0MB

          MD5

          bd40ff3d0ce8d338a1fe4501cd8e9a09

          SHA1

          3aae8c33bf0ec9adf5fbf8a361445969de409b49

          SHA256

          ebda776a2a353f8f0690b1c7706b0cdaff3d23e1618515d45e451fc19440501c

          SHA512

          404fb3c107006b832b8e900f6e27873324cd0a7946cdccf4ffeea365a725892d929e8b160379af9782bcd6cfeb4c3c805740e21280b42bb2ce8f39f26792e5a1

        • C:\Users\Admin\AppData\Local\Temp\Tor\libssl-1_1.dll
          Filesize

          1.1MB

          MD5

          9e3d55fbf890c6cbffd836f2aef4ba31

          SHA1

          715890ba3bda3431470cca4f4bc492c0f63fa138

          SHA256

          e6f4cf41373e8770c670cf5e85461f25385314ed9d8a2b37381bc84f5c0dd5c0

          SHA512

          9848f28fd96c21dd054cbf3e722e56373696c1f7803c137afc7c7203325d9738fa6b984d95cd49ff78a6d95c8f9406f869af3c3783901da3cc003e2b09497d65

        • C:\Users\Admin\AppData\Local\Temp\Tor\libssp-0.dll
          Filesize

          246KB

          MD5

          b77328da7cead5f4623748a70727860d

          SHA1

          13b33722c55cca14025b90060e3227db57bf5327

          SHA256

          46541d9e28c18bc11267630920b97c42f104c258b55e2f62e4a02bcd5f03e0e7

          SHA512

          2f1bd13357078454203092ed5ddc23a8baa5e64202fba1e4f98eacf1c3c184616e527468a96ff36d98b9324426dddfa20b62b38cf95c6f5c0dc32513ebace9e2

        • C:\Users\Admin\AppData\Local\Temp\Tor\libwinpthread-1.dll
          Filesize

          512KB

          MD5

          19d7cc4377f3c09d97c6da06fbabc7dc

          SHA1

          3a3ba8f397fb95ed5df22896b2c53a326662fcc9

          SHA256

          228fcfe9ed0574b8da32dd26eaf2f5dbaef0e1bd2535cb9b1635212ccdcbf84d

          SHA512

          23711285352cdec6815b5dd6e295ec50568fab7614706bc8d5328a4a0b62991c54b16126ed9e522471d2367b6f32fa35feb41bfa77b3402680d9a69f53962a4a

        • C:\Users\Admin\AppData\Local\Temp\Tor\tor.exe
          Filesize

          4.0MB

          MD5

          67ab12cf6cabc14588e4f51b21c2134a

          SHA1

          32a4ff564f38bf4b62007e419f19c991e60d6e14

          SHA256

          f0aaae0364306bb7a4681d01935c96c2ac76b3576b7982990f86bcaf811a45ba

          SHA512

          2a1c67e9d23d6b050e35c5a8e159309cf598095239406c60a9f721fddc912e21afab7036cbd9f77197cc4241df5f8fa6aa9d7294762659178c6edeb4699d5bec

        • C:\Users\Admin\AppData\Local\Temp\Tor\zlib1.dll
          Filesize

          121KB

          MD5

          6f98da9e33cd6f3dd60950413d3638ac

          SHA1

          e630bdf8cebc165aa81464ff20c1d55272d05675

          SHA256

          219d9d5bf0de4c2251439c89dd5f2959ee582e7f9f7d5ff66a29c88753a3a773

          SHA512

          2983faaf7f47a8f79a38122aa617e65e7deddd19ba9a98b62acf17b48e5308099b852f21aaf8ca6fe11e2cc76c36eed7ffa3307877d4e67b1659fe6e4475205c

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
          Filesize

          7KB

          MD5

          67576c97c2aa1621dbb9c386b4ac020c

          SHA1

          76bc487a606a9a725840dcd836849a9c414647b0

          SHA256

          68332be956c7c3edff8abf6f344fcd05d36ee62f9cacbf020d838e85183c93bb

          SHA512

          4d5967d32c5d1ab285f2f70df2e1c1986a00521e1cddd0d6313d616b426839ef678c9acfabfd1d876bed71700b0f7e9014df67ac7bebfcb8e9ce1aff3184a666

        • \Users\Admin\AppData\Local\Temp\Tor\libcrypto-1_1.dll
          Filesize

          3.5MB

          MD5

          3406f79392c47a72bed2f0067b3ce466

          SHA1

          a8e2940d61fc840441c4e2a835959d197929ffdf

          SHA256

          e4b6b2ca32b1e2ba26959ec7380c4f117418d3a724f60494ff3cb81505fbf43d

          SHA512

          930d794aa8715dcd23fafbead7fe2ec95d2863783b4c52279870cad93d5b6cf02ba8a13e2653d2bf731e9882bf63f43a7e44788ce47505346be3fe8e8b872fa4

        • \Users\Admin\AppData\Local\Temp\Tor\libevent-2-1-7.dll
          Filesize

          1.1MB

          MD5

          a3bf8e33948d94d490d4613441685eee

          SHA1

          75ed7f6e2855a497f45b15270c3ad4aed6ad02e2

          SHA256

          91c812a33871e40b264761f1418e37ebfeb750fe61ca00cbcbe9f3769a8bf585

          SHA512

          c20ef2efcacb5f8c7e2464de7fde68bf610ab2e0608ff4daed9bf676996375db99bee7e3f26c5bd6cca63f9b2d889ed5460ec25004130887cd1a90b892be2b28

        • \Users\Admin\AppData\Local\Temp\Tor\libgcc_s_sjlj-1.dll
          Filesize

          1.0MB

          MD5

          bd40ff3d0ce8d338a1fe4501cd8e9a09

          SHA1

          3aae8c33bf0ec9adf5fbf8a361445969de409b49

          SHA256

          ebda776a2a353f8f0690b1c7706b0cdaff3d23e1618515d45e451fc19440501c

          SHA512

          404fb3c107006b832b8e900f6e27873324cd0a7946cdccf4ffeea365a725892d929e8b160379af9782bcd6cfeb4c3c805740e21280b42bb2ce8f39f26792e5a1

        • \Users\Admin\AppData\Local\Temp\Tor\libssl-1_1.dll
          Filesize

          1.1MB

          MD5

          9e3d55fbf890c6cbffd836f2aef4ba31

          SHA1

          715890ba3bda3431470cca4f4bc492c0f63fa138

          SHA256

          e6f4cf41373e8770c670cf5e85461f25385314ed9d8a2b37381bc84f5c0dd5c0

          SHA512

          9848f28fd96c21dd054cbf3e722e56373696c1f7803c137afc7c7203325d9738fa6b984d95cd49ff78a6d95c8f9406f869af3c3783901da3cc003e2b09497d65

        • \Users\Admin\AppData\Local\Temp\Tor\libssp-0.dll
          Filesize

          246KB

          MD5

          b77328da7cead5f4623748a70727860d

          SHA1

          13b33722c55cca14025b90060e3227db57bf5327

          SHA256

          46541d9e28c18bc11267630920b97c42f104c258b55e2f62e4a02bcd5f03e0e7

          SHA512

          2f1bd13357078454203092ed5ddc23a8baa5e64202fba1e4f98eacf1c3c184616e527468a96ff36d98b9324426dddfa20b62b38cf95c6f5c0dc32513ebace9e2

        • \Users\Admin\AppData\Local\Temp\Tor\libwinpthread-1.dll
          Filesize

          512KB

          MD5

          19d7cc4377f3c09d97c6da06fbabc7dc

          SHA1

          3a3ba8f397fb95ed5df22896b2c53a326662fcc9

          SHA256

          228fcfe9ed0574b8da32dd26eaf2f5dbaef0e1bd2535cb9b1635212ccdcbf84d

          SHA512

          23711285352cdec6815b5dd6e295ec50568fab7614706bc8d5328a4a0b62991c54b16126ed9e522471d2367b6f32fa35feb41bfa77b3402680d9a69f53962a4a

        • \Users\Admin\AppData\Local\Temp\Tor\tor.exe
          Filesize

          4.0MB

          MD5

          67ab12cf6cabc14588e4f51b21c2134a

          SHA1

          32a4ff564f38bf4b62007e419f19c991e60d6e14

          SHA256

          f0aaae0364306bb7a4681d01935c96c2ac76b3576b7982990f86bcaf811a45ba

          SHA512

          2a1c67e9d23d6b050e35c5a8e159309cf598095239406c60a9f721fddc912e21afab7036cbd9f77197cc4241df5f8fa6aa9d7294762659178c6edeb4699d5bec

        • \Users\Admin\AppData\Local\Temp\Tor\tor.exe
          Filesize

          4.0MB

          MD5

          67ab12cf6cabc14588e4f51b21c2134a

          SHA1

          32a4ff564f38bf4b62007e419f19c991e60d6e14

          SHA256

          f0aaae0364306bb7a4681d01935c96c2ac76b3576b7982990f86bcaf811a45ba

          SHA512

          2a1c67e9d23d6b050e35c5a8e159309cf598095239406c60a9f721fddc912e21afab7036cbd9f77197cc4241df5f8fa6aa9d7294762659178c6edeb4699d5bec

        • \Users\Admin\AppData\Local\Temp\Tor\zlib1.dll
          Filesize

          121KB

          MD5

          6f98da9e33cd6f3dd60950413d3638ac

          SHA1

          e630bdf8cebc165aa81464ff20c1d55272d05675

          SHA256

          219d9d5bf0de4c2251439c89dd5f2959ee582e7f9f7d5ff66a29c88753a3a773

          SHA512

          2983faaf7f47a8f79a38122aa617e65e7deddd19ba9a98b62acf17b48e5308099b852f21aaf8ca6fe11e2cc76c36eed7ffa3307877d4e67b1659fe6e4475205c

        • memory/644-87-0x0000000000000000-mapping.dmp
        • memory/692-64-0x000000006ED00000-0x000000006F2AB000-memory.dmp
          Filesize

          5.7MB

        • memory/692-60-0x0000000000000000-mapping.dmp
        • memory/692-63-0x000000006ED00000-0x000000006F2AB000-memory.dmp
          Filesize

          5.7MB

        • memory/692-62-0x000000006ED00000-0x000000006F2AB000-memory.dmp
          Filesize

          5.7MB

        • memory/1036-85-0x000000006ECD0000-0x000000006F27B000-memory.dmp
          Filesize

          5.7MB

        • memory/1036-67-0x0000000000000000-mapping.dmp
        • memory/1076-57-0x0000000000000000-mapping.dmp
        • memory/1348-58-0x0000000000000000-mapping.dmp
        • memory/1408-65-0x0000000000000000-mapping.dmp
        • memory/1664-68-0x0000000000000000-mapping.dmp
        • memory/1756-110-0x0000000070240000-0x000000007033B000-memory.dmp
          Filesize

          1004KB

        • memory/1756-93-0x0000000000000000-mapping.dmp
        • memory/1756-118-0x0000000000AB0000-0x0000000000EC3000-memory.dmp
          Filesize

          4.1MB

        • memory/1756-117-0x0000000000AB0000-0x0000000000EC3000-memory.dmp
          Filesize

          4.1MB

        • memory/1756-116-0x0000000070D80000-0x0000000070DA6000-memory.dmp
          Filesize

          152KB

        • memory/1756-115-0x000000006FC60000-0x000000006FD46000-memory.dmp
          Filesize

          920KB

        • memory/1756-114-0x000000006FD50000-0x0000000070045000-memory.dmp
          Filesize

          3.0MB

        • memory/1756-113-0x0000000070240000-0x000000007033B000-memory.dmp
          Filesize

          1004KB

        • memory/1756-112-0x0000000000AB0000-0x0000000000EC3000-memory.dmp
          Filesize

          4.1MB

        • memory/1756-111-0x0000000070D80000-0x0000000070DA6000-memory.dmp
          Filesize

          152KB

        • memory/1780-88-0x0000000000000000-mapping.dmp
        • memory/1860-79-0x0000000000454BCE-mapping.dmp
        • memory/1860-78-0x0000000000400000-0x000000000045A000-memory.dmp
          Filesize

          360KB

        • memory/1860-83-0x0000000000400000-0x000000000045A000-memory.dmp
          Filesize

          360KB

        • memory/1860-81-0x0000000000400000-0x000000000045A000-memory.dmp
          Filesize

          360KB

        • memory/1860-77-0x0000000000400000-0x000000000045A000-memory.dmp
          Filesize

          360KB

        • memory/1860-76-0x0000000000400000-0x000000000045A000-memory.dmp
          Filesize

          360KB

        • memory/1860-73-0x0000000000400000-0x000000000045A000-memory.dmp
          Filesize

          360KB

        • memory/1860-74-0x0000000000400000-0x000000000045A000-memory.dmp
          Filesize

          360KB

        • memory/1884-66-0x0000000000000000-mapping.dmp
        • memory/1932-86-0x0000000000000000-mapping.dmp
        • memory/1976-89-0x0000000000000000-mapping.dmp
        • memory/2016-55-0x0000000075D61000-0x0000000075D63000-memory.dmp
          Filesize

          8KB

        • memory/2016-56-0x0000000006070000-0x00000000062FC000-memory.dmp
          Filesize

          2.5MB

        • memory/2016-72-0x0000000005370000-0x00000000053D6000-memory.dmp
          Filesize

          408KB

        • memory/2016-54-0x0000000000D10000-0x0000000000D18000-memory.dmp
          Filesize

          32KB