purecrypter | 4134bd82bbea78103d0e32728df856870eaa2c0188b59423115c7d779b2bf83a | Triage

Analysis

max time kernel
39s
max time network
135s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-02-2023 04:56

Sharing

Report Analysis Logs

General

Target

679104fb0479ff61c4b5e4b88f77d94b.exe
Size

6KB
MD5

679104fb0479ff61c4b5e4b88f77d94b
SHA1

bfbcb5d48fb4ab25d52e4e1bedf37a4e7a4a3cab
SHA256

4134bd82bbea78103d0e32728df856870eaa2c0188b59423115c7d779b2bf83a
SHA512

7cb36200865267885939956614a7b8603cd16575a3857e0ecc238ff22d296b29bfb208bb11f61f3856278f6b4585afdb2c8456d2f2630f0fbc33fa298df0253e
SSDEEP

192:zU3efq7iEM9gdH98dfQbLE5lF22vjWwID:Q3efq7iEM9gdH98dfgLE5lI2vjlI

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

C2

https://onedrive.live.com/download?cid=A113DD34A0D77810&resid=A113DD34A0D77810%21125&authkey=AIgE8y9D-kUp_qA

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1784 1944 WerFault.exe 679104fb0479ff61c4b5e4b88f77d94b.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

679104fb0479ff61c4b5e4b88f77d94b.exe

description pid process

Token: SeDebugPrivilege 1944 679104fb0479ff61c4b5e4b88f77d94b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

679104fb0479ff61c4b5e4b88f77d94b.exe

description	pid	process	target process
PID 1944 wrote to memory of 1784	1944	679104fb0479ff61c4b5e4b88f77d94b.exe	WerFault.exe
PID 1944 wrote to memory of 1784	1944	679104fb0479ff61c4b5e4b88f77d94b.exe	WerFault.exe
PID 1944 wrote to memory of 1784	1944	679104fb0479ff61c4b5e4b88f77d94b.exe	WerFault.exe
PID 1944 wrote to memory of 1784	1944	679104fb0479ff61c4b5e4b88f77d94b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\679104fb0479ff61c4b5e4b88f77d94b.exe
"C:\Users\Admin\AppData\Local\Temp\679104fb0479ff61c4b5e4b88f77d94b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 1768
2⤵
- Program crash
PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1784-56-0x0000000000000000-mapping.dmp

Download
memory/1944-54-0x0000000000060000-0x0000000000068000-memory.dmp

Filesize
32KB

Download
memory/1944-55-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download