Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05-02-2023 01:06
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20221111-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Detect PureCrypter injector 1 IoCs
resource yara_rule behavioral1/memory/692-66-0x0000000006600000-0x00000000069A0000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Executes dropped EXE 2 IoCs
pid Process 1416 voiceadequovl.exe 692 voiceadequovl.exe -
Loads dropped DLL 4 IoCs
pid Process 1416 voiceadequovl.exe 1416 voiceadequovl.exe 1416 voiceadequovl.exe 1416 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1280 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 692 voiceadequovl.exe Token: SeDebugPrivilege 1280 powershell.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1736 wrote to memory of 1416 1736 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 1736 wrote to memory of 1416 1736 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 1736 wrote to memory of 1416 1736 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 1736 wrote to memory of 1416 1736 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 1416 wrote to memory of 692 1416 voiceadequovl.exe 29 PID 1416 wrote to memory of 692 1416 voiceadequovl.exe 29 PID 1416 wrote to memory of 692 1416 voiceadequovl.exe 29 PID 1416 wrote to memory of 692 1416 voiceadequovl.exe 29 PID 692 wrote to memory of 1280 692 voiceadequovl.exe 30 PID 692 wrote to memory of 1280 692 voiceadequovl.exe 30 PID 692 wrote to memory of 1280 692 voiceadequovl.exe 30 PID 692 wrote to memory of 1280 692 voiceadequovl.exe 30 PID 692 wrote to memory of 108 692 voiceadequovl.exe 32 PID 692 wrote to memory of 108 692 voiceadequovl.exe 32 PID 692 wrote to memory of 108 692 voiceadequovl.exe 32 PID 692 wrote to memory of 108 692 voiceadequovl.exe 32 PID 108 wrote to memory of 1528 108 cmd.exe 34 PID 108 wrote to memory of 1528 108 cmd.exe 34 PID 108 wrote to memory of 1528 108 cmd.exe 34 PID 108 wrote to memory of 1528 108 cmd.exe 34 PID 692 wrote to memory of 1624 692 voiceadequovl.exe 35 PID 692 wrote to memory of 1624 692 voiceadequovl.exe 35 PID 692 wrote to memory of 1624 692 voiceadequovl.exe 35 PID 692 wrote to memory of 1624 692 voiceadequovl.exe 35 PID 692 wrote to memory of 1624 692 voiceadequovl.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1280
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵PID:1528
-
-
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵PID:1624
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵PID:360
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵PID:2040
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
Filesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD551d2eff77a9f0dd44903c952fadcbea9
SHA1a276eb32c792924148988858529c18bb0aac3752
SHA256411a9c250a987e86c9467949928a7076458b74fd207769f12355bb6921e15676
SHA5128b370dfcc46a29afc1f93ee75eaa427dc7bf556aaa024be23c8d2ef92d06f1ae4cdf03862afa9812cd1382a5134cf3c948e9f4eb8572fba34b62a5713eb1762e
-
Filesize
245.2MB
MD57a6c9bf8823b7a6a3f1a8b379386b347
SHA168506d411afa1d2d7727132b1f9e2898d283d407
SHA256c874a255109babc2b39ba1223805f4ca8e3e1cc203d009e04509dbc270f2a675
SHA512be90d76d84f4dd481baeb097d23d44f4b11ab6365675f7b70dcc1814654ad65da585f23fe2a07cc347ce572bee9022f9fc9a745b99390969044f5f1be1ccc562
-
Filesize
237.1MB
MD5cdb83a59bb4ee28584509166d73a6b6a
SHA195e75904d21d573c2b33d526b8ad5e6b575a7fb5
SHA256d5aaf3674aaa3d6c5aab42b0281115c1152106dbc9f4b8ccf5296fa0d33d57f1
SHA5123345ccbde0a6763a5e568c137dfd7af4d20713375e5bfa911d5dbe4499dd677bac8970989438c929dd57708d4df405e3f670f10aecac47fafa2ee7d747e0d47d
-
Filesize
44.2MB
MD54e0ee541936eda55f1fb600340ae8cb7
SHA1c7c716ea601e54d91a786f3222c8995082bbeb82
SHA25627610219167f39ba791bcad5205d2497704f623aae4ea3b48e4f99b84afb0bfa
SHA51258e46f0cd2ace6f6d84117e63f1591772d5558f73b3d14ea4689f4a7878eb974d701f77988d79429b3b4dce4fe6d45d24ef77ba1eb4e5eaa288f0c53bd4efe43
-
Filesize
210.2MB
MD54a9c4a5aeed110ee25b8c58f60e4e479
SHA176df73b2865edd261875dcfae7b14e7382cc37b8
SHA256fa8d56fb8c3f2249e2881caf806e5963409aa5386f7652a2130a8eb128ef6c7c
SHA512ff3af842c9a194e27e7b1f279f35367e4fd1ce265ca394f6abf9a452bcef96de77fda7d6365e410d3e7cbb38f3d9dfde602054995534bab03d3841ba0a52d88b
-
Filesize
247.6MB
MD55edcd39a21dc51b104cfa47768c14608
SHA1cfb3c36f2a3642536eaa1914b75fc0b4e296f9ba
SHA2565030e41d191b43c50d653ebd31efa9a84baa4000353cd858eac425f736171d8e
SHA5120eba6e5a18f53e89c097947f1f8ca8720b4414153e4d68332def0ac211e95bcd3231827700047e204b8f316ee788fc628299316833405d1da289a9c183a66c06
-
Filesize
254.2MB
MD58968fbd2ead02dd325159bb6b66b0196
SHA1d64c4d4e25fc74d6ee623c9c5ad2df5fc09c8ef2
SHA2567c67f2b2644b955dbaa72cfa51323268af25ff901e92fe6df9fcf0db75f28374
SHA51249de72722f466d9f6fc58dd71784fa2583277fc646da3ed866d99dfb8b04ea4d97140d1ce98c465170d67a5f6686688aa4b09adb34d020eb592ea9a72aa88df3
-
Filesize
232.4MB
MD5a5889cea3c5442359e3e438f5fdb4e18
SHA18e6aed95a852a14adf14bddf07e3ee1f0816ce59
SHA25657ff2240c3212b7a1aa467c9c64f2788b9bc3d260dd316dc5ee429a71ebd20b9
SHA512c47042e5e1cb0998b5b373507af0ae8b23f120ff5138fe94c87b0b0e7dcd43ef16e3ca0894e3fefc6508a85730d12fc68897ca3f6de4c01732e78e0740222792