Analysis
-
max time kernel
84s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-02-2023 11:05
Static task
static1
Behavioral task
behavioral1
Sample
cdb75538c7adc7829a93cdf9a27c1fd7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cdb75538c7adc7829a93cdf9a27c1fd7.exe
Resource
win10v2004-20220812-en
General
-
Target
cdb75538c7adc7829a93cdf9a27c1fd7.exe
-
Size
3.0MB
-
MD5
cdb75538c7adc7829a93cdf9a27c1fd7
-
SHA1
2e5ff4e8f2b4b087ccc7f4cb2ad59d4c3617a0c9
-
SHA256
dd218eb78e26587e43df5f00ff3ad87e23154c672615309a193a657323b62e20
-
SHA512
f6eab79f9ba0111608ddc3b81b57224e5ccc86f2a4b3f14a11ef627a2d44f6539c061d5bcad7a68f7df0c05bbcb14d0285bfa508085233075452a3a75d1671d4
-
SSDEEP
98304:k5Sh7zrcGtirr9gIKvvwPDxISVNImdJ3R9/4:WAXrjtirrGIyYTD3R9A
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1248-55-0x000000001FCC0000-0x000000001FFA6000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.execdb75538c7adc7829a93cdf9a27c1fd7.exepid process 676 powershell.exe 1248 cdb75538c7adc7829a93cdf9a27c1fd7.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
cdb75538c7adc7829a93cdf9a27c1fd7.exepowershell.exedescription pid process Token: SeDebugPrivilege 1248 cdb75538c7adc7829a93cdf9a27c1fd7.exe Token: SeDebugPrivilege 676 powershell.exe Token: SeDebugPrivilege 1248 cdb75538c7adc7829a93cdf9a27c1fd7.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cdb75538c7adc7829a93cdf9a27c1fd7.exedescription pid process target process PID 1248 wrote to memory of 676 1248 cdb75538c7adc7829a93cdf9a27c1fd7.exe powershell.exe PID 1248 wrote to memory of 676 1248 cdb75538c7adc7829a93cdf9a27c1fd7.exe powershell.exe PID 1248 wrote to memory of 676 1248 cdb75538c7adc7829a93cdf9a27c1fd7.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdb75538c7adc7829a93cdf9a27c1fd7.exe"C:\Users\Admin\AppData\Local\Temp\cdb75538c7adc7829a93cdf9a27c1fd7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANgA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/676-64-0x0000000002564000-0x0000000002567000-memory.dmpFilesize
12KB
-
memory/676-58-0x000007FEFBD11000-0x000007FEFBD13000-memory.dmpFilesize
8KB
-
memory/676-57-0x0000000000000000-mapping.dmp
-
memory/676-62-0x000000000256B000-0x000000000258A000-memory.dmpFilesize
124KB
-
memory/676-65-0x000000000256B000-0x000000000258A000-memory.dmpFilesize
124KB
-
memory/676-59-0x000007FEECB70000-0x000007FEED593000-memory.dmpFilesize
10.1MB
-
memory/676-60-0x000007FEEC010000-0x000007FEECB6D000-memory.dmpFilesize
11.4MB
-
memory/676-61-0x0000000002564000-0x0000000002567000-memory.dmpFilesize
12KB
-
memory/1248-67-0x000000001D0F0000-0x000000001D188000-memory.dmpFilesize
608KB
-
memory/1248-63-0x000000001AED7000-0x000000001AEF6000-memory.dmpFilesize
124KB
-
memory/1248-56-0x000000001AED7000-0x000000001AEF6000-memory.dmpFilesize
124KB
-
memory/1248-55-0x000000001FCC0000-0x000000001FFA6000-memory.dmpFilesize
2.9MB
-
memory/1248-54-0x000000013F6E0000-0x000000013F9E6000-memory.dmpFilesize
3.0MB
-
memory/1248-66-0x000000001C3E0000-0x000000001C4B6000-memory.dmpFilesize
856KB
-
memory/1248-68-0x000000001D5B0000-0x000000001D664000-memory.dmpFilesize
720KB
-
memory/1248-71-0x000000001BE70000-0x000000001BEBC000-memory.dmpFilesize
304KB
-
memory/1248-70-0x000000001BD90000-0x000000001BDE4000-memory.dmpFilesize
336KB
-
memory/1248-69-0x000000001BB10000-0x000000001BB66000-memory.dmpFilesize
344KB
-
memory/1248-72-0x000000001C5A0000-0x000000001C63B000-memory.dmpFilesize
620KB
-
memory/1248-73-0x000000001C4C0000-0x000000001C514000-memory.dmpFilesize
336KB
-
memory/1248-74-0x000000001AED7000-0x000000001AEF6000-memory.dmpFilesize
124KB