purecrypter | 53ddb9a75bca1115a66745b28086afbd394cef38f8437dda641b1219111df8cd

Analysis

max time kernel
151s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-02-2023 19:18

Target

d7fa6d87594ea4d8b5740d54fdc204b08f4e9439.exe
Size

7KB
MD5

b359f4af5c88b1e237db9738415b7682
SHA1

d7fa6d87594ea4d8b5740d54fdc204b08f4e9439
SHA256

53ddb9a75bca1115a66745b28086afbd394cef38f8437dda641b1219111df8cd
SHA512

6d4f06f36c608d3202d29629f9d9a70eadfbffbb23c7c074fbb610ed9e1926bf6e04c8dfecbbaf1d575fb2d0385d237aff2dbda322b092d4ef7728091eb596cb
SSDEEP

96:xtEsKVeCVIP7bLp8LAn5c8aY1ej/kKV+J2qzNt:xUVVIP7bLrEOejcKYx

Score

10^/10

Detect PureCrypter injector 1 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/288-56-0x0000000007440000-0x00000000076DE000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1592 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

d7fa6d87594ea4d8b5740d54fdc204b08f4e9439.exepowershell.exe

description pid process

Token: SeDebugPrivilege 288 d7fa6d87594ea4d8b5740d54fdc204b08f4e9439.exe
Token: SeDebugPrivilege 1592 powershell.exe

pid	process
1592	powershell.exe

description	pid	process
Token: SeDebugPrivilege	288	d7fa6d87594ea4d8b5740d54fdc204b08f4e9439.exe
Token: SeDebugPrivilege	1592	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d7fa6d87594ea4d8b5740d54fdc204b08f4e9439.exe

description	pid	process	target process
PID 288 wrote to memory of 1592	288	d7fa6d87594ea4d8b5740d54fdc204b08f4e9439.exe	powershell.exe
PID 288 wrote to memory of 1592	288	d7fa6d87594ea4d8b5740d54fdc204b08f4e9439.exe	powershell.exe
PID 288 wrote to memory of 1592	288	d7fa6d87594ea4d8b5740d54fdc204b08f4e9439.exe	powershell.exe
PID 288 wrote to memory of 1592	288	d7fa6d87594ea4d8b5740d54fdc204b08f4e9439.exe	powershell.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/288-54-0x0000000000ED0000-0x0000000000ED8000-memory.dmp

Filesize
32KB

Download
memory/288-55-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/288-56-0x0000000007440000-0x00000000076DE000-memory.dmp

Filesize
2.6MB

Download
memory/1592-57-0x0000000000000000-mapping.dmp

Download
memory/1592-59-0x000000006F3D0000-0x000000006F97B000-memory.dmp

Filesize
5.7MB

Download
memory/1592-60-0x000000006F3D0000-0x000000006F97B000-memory.dmp

Filesize
5.7MB

Download
memory/1592-61-0x000000006F3D0000-0x000000006F97B000-memory.dmp

Filesize
5.7MB

Download