Analysis

  • max time kernel
    141s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05/02/2023, 01:13

General

  • Target

    5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

  • Size

    3.6MB

  • MD5

    36fd273ea7607d3a203f257f4e2649ed

  • SHA1

    5e243f79ecb539d0d1f75fce7ddfedeccee70a48

  • SHA256

    471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747

  • SHA512

    cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d

  • SSDEEP

    98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh

Malware Config

Signatures

  • Detect PureCrypter injector 1 IoCs
  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
    "C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:856
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:896
      • C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
        "C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1756
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1964

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

    Filesize

    365.5MB

    MD5

    ba50f2bca86ba947a8d2035bb9b35123

    SHA1

    a542b5c5d41174dc2475a219978123b7d14f958f

    SHA256

    17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

    SHA512

    08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

    Filesize

    365.5MB

    MD5

    ba50f2bca86ba947a8d2035bb9b35123

    SHA1

    a542b5c5d41174dc2475a219978123b7d14f958f

    SHA256

    17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

    SHA512

    08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

  • C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

    Filesize

    222.0MB

    MD5

    dee03006815a9ba6269bec665ff8dfeb

    SHA1

    f19bb01a6774699574105a8402bfc38c9f5aafc5

    SHA256

    11569a215faa3caa27bd61eddb56f89ec05d87795dd033054ff4787780c25675

    SHA512

    d3322f31c3f340a04c7a388d69c579c266a583fa1edfc7920ddce1efe2e09f45ba8be7eb815c7a55431cf434223e9d802bd7bcaf548cb432a6cb34c45926fbee

  • C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

    Filesize

    211.8MB

    MD5

    9ed9651d012f3848dbdb36caf1be23e7

    SHA1

    940bd78348e453bdf0a56c8fbdb17e3d5365a526

    SHA256

    d09f066049fd3414c578612d7a41c7cba3be38d41ec250eb17644b36043b1d02

    SHA512

    d9e1fb6ca800203c7a53d9a28c146dabcd14d02fad97427d22ac002cc413bd84b487ad6793275567c5427fb5a85fae1211d6e2e7951decb5099d163db3ac1eb5

  • \Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

    Filesize

    187.3MB

    MD5

    f98392363e9e140573229440922e9941

    SHA1

    2434cf3818b1e2fd8ae7fcff1126e7f1a38e0b33

    SHA256

    19e5ef1b5c35edb5dc66281a4ea11a02c4ace9bd1df1130cec97988fd056e29d

    SHA512

    40140b4a5f7d27c6fcf4b60b884f229b75f16eb100a51c8e0af955267f72fa4d6b0c13b372cbc39231bf58e6b13957d10f03b17b47bb7fa89dddc5e88bb07373

  • \Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

    Filesize

    228.6MB

    MD5

    6bcb2b74b63fedd51b7437ee775480a0

    SHA1

    5e827cb85bd11cbd53046ec891b0626964bc6b25

    SHA256

    98cd6f5f795a610a999dcfea5dab6be8061ea8b81cc59b2805a17e21159dda1e

    SHA512

    d8855d973c671ca503174e80cd5dc39aa8cf0e45e6bec0ff2f7172535b3a794f14936a49422a60fd5c76547dfa820daf8122834fbbc025a737d7105201ce8237

  • \Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

    Filesize

    229.0MB

    MD5

    1058e6af7a12002968fe963af446b012

    SHA1

    e27121c5e338d09810db67bc318ee26eb6f3bd07

    SHA256

    c2b2d41f8dc1e9e3be9f8fc506c86fe3bac716896434788c789d3dfb064b7f09

    SHA512

    d8f758ac9b5e4b0b52a79f1e8e1b76d67f3417a3341cc5511b714a5269158ce8ad049e4372a15329ba1e4a8ad10aa533b3a1fadf7574815d7a8623fdb2d3bb11

  • \Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

    Filesize

    231.1MB

    MD5

    cd68fc2a7272eafedca4434d67cdff5d

    SHA1

    8a1c9bbef029e2c8ea061db600d32773ea742941

    SHA256

    66ae7bdf8386ce1fff1cf2e5f626852c44f32728517a2b13cfb2c3b24f5c99f2

    SHA512

    9f3412889fbf3b67645e2a3cc44069340baebd4c936c472f123116d9cb86aa149d5ca7e533d5ede955ded7f8d1ee0f65d895e7da71c204d24cf6c682636bad7c

  • memory/896-56-0x0000000075D01000-0x0000000075D03000-memory.dmp

    Filesize

    8KB

  • memory/1756-65-0x00000000003B0000-0x0000000000B24000-memory.dmp

    Filesize

    7.5MB

  • memory/1756-66-0x0000000006450000-0x00000000067F0000-memory.dmp

    Filesize

    3.6MB

  • memory/1964-69-0x000000006FF50000-0x00000000704FB000-memory.dmp

    Filesize

    5.7MB

  • memory/1964-70-0x000000006FF50000-0x00000000704FB000-memory.dmp

    Filesize

    5.7MB