Overview

overview

10

Static

static

1

Loader.exe

windows7-x64

10

Loader.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b66229a5104d24f542566d43309673958eef9053

  • Size

    1.6MB

  • Sample

    230203-xcy3ragf65

  • MD5

    51c7a3718df0b69af01448f9579c64e2

  • SHA1

    b66229a5104d24f542566d43309673958eef9053

  • SHA256

    752e7d326d94fefa12869bee8c54bfb197d193f151d72f936457a27bbd6b6877

  • SHA512

    6ff620f4367f545aadeff8bad1e894b7561c7e2a4423d42fc8ccde995a05b0a82e26010e0fb5379a8bcbdd743bb434b10962e48fd65ec0ac40f953240e69be79

  • SSDEEP

    49152:MNRPjZGI8HDtJL92m/nNrMs6n8jMUBra1:GLZGhRdtjXO

Score
10/10
purecrypterxmrigdownloaderloaderminerpersistence

Malware Config

Targets

    • Target

      Loader.exe

    • Size

      1.6MB

    • MD5

      a44e526804469076d712e8a05ddd7759

    • SHA1

      7010fda540e70139020a7a79730e74e99bd8e6c9

    • SHA256

      46d7128963bde013c8ec359b285e47eabbf9c88e332735e02ced518773e8e95f

    • SHA512

      04c40ef00c80d641c4f7bced8aefc180d695ea23ef79e272167f1a567484be2ab7031ca55a246cbeba1ed0c0ed93223fc2a33daed7f2048c62f169f0e6325b36

    • SSDEEP

      49152:fBvdZG5o8InNXL9Qn0HpZjI64n2hcyfT2:pFZG5oNnRfh9

    Score
    10/10
    purecrypterdownloaderloaderpersistencexmrigminer

    • Detect PureCrypter injector

      loader

    • Modifies WinLogon for persistence

      persistence

    • PureCrypter

      PureCrypter is a .NET malware loader first seen in early 2021.

      loaderdownloaderpurecrypter

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks