purecrypter | 471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747

General

Target

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Size

3.6MB
MD5

36fd273ea7607d3a203f257f4e2649ed
SHA1

5e243f79ecb539d0d1f75fce7ddfedeccee70a48
SHA256

471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
SHA512

cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
SSDEEP

98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh

Score

10^/10

purecrypter downloader loader persistence

Malware Config

Signatures

Detect PureCrypter injector 1 IoCs

loader

resource	yara_rule
behavioral1/memory/472-66-0x0000000006220000-0x00000000065C0000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Executes dropped EXE 2 IoCs

pid	Process
1716	voiceadequovl.exe
472	voiceadequovl.exe

Loads dropped DLL 4 IoCs

pid	Process
1716	voiceadequovl.exe
1716	voiceadequovl.exe
1716	voiceadequovl.exe
1716	voiceadequovl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1984	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	472	voiceadequovl.exe
Token: SeDebugPrivilege	1984	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1716	2008	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 2008 wrote to memory of 1716	2008	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 2008 wrote to memory of 1716	2008	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 2008 wrote to memory of 1716	2008	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 1716 wrote to memory of 472	1716	voiceadequovl.exe	29
PID 1716 wrote to memory of 472	1716	voiceadequovl.exe	29
PID 1716 wrote to memory of 472	1716	voiceadequovl.exe	29
PID 1716 wrote to memory of 472	1716	voiceadequovl.exe	29
PID 472 wrote to memory of 1984	472	voiceadequovl.exe	30
PID 472 wrote to memory of 1984	472	voiceadequovl.exe	30
PID 472 wrote to memory of 1984	472	voiceadequovl.exe	30
PID 472 wrote to memory of 1984	472	voiceadequovl.exe	30

C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
    "C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:472
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

Filesize
274.9MB

MD5
3da5a0fae8b401f9c26485aa255fa642

SHA1
95811b04c64facdffb3e0e5f7e08dd6c570b60c2

SHA256
b814444192c8a4aa8679a530842605e3377ac2028356f1c2c9172ae30cfc9d14

SHA512
b3488dd08032b96e3b6f7510b6f778c8934c7618d9ecd16f60b7bb91167abfd1072961f0ebadd063cf9fb2bf79e2d8c94f7fcce36b663d7b9e7356fa08520a3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

Filesize
365.5MB

MD5
ba50f2bca86ba947a8d2035bb9b35123

SHA1
a542b5c5d41174dc2475a219978123b7d14f958f

SHA256
17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

SHA512
08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
288.8MB

MD5
02f2ab70abda527b0424ce5a08202bc0

SHA1
562db5b8c85fbd0b0a8a040366d12ea28acfb5a3

SHA256
be167aa0c28a8130c69c87aef8aa5bbf280f5aaf5bf8b0c7df8584deabceacbb

SHA512
55ff7de6498860f06ece4f0b4194112f69275e618079bd15f90f021f5203c88a4bb8ff848264c5ab18e59c816bcb334528a0d8e78904d922526f655262172486

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
259.9MB

MD5
24c4e1e983c063ffc4dda1be8dfd14be

SHA1
24a75878bb8c92e0a05d4bc5363c53c564781afb

SHA256
357edde0405ba9174922d444f588a2f3d3f1256509cc630563eaaaecfd1adb44

SHA512
d0f1035e7c0fc16edf3f9ab582efd79efab982f4d02be24622552f826d57cbcac4b5a73850e74240798c83e38a99f0e17c3c7def7effa2021e0a6614baa18fe3

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
291.6MB

MD5
2ad157e049ca2ad312ad5105acaf724a

SHA1
56acd80358f1ed4aea72afc4ca2ccee11a21e1bf

SHA256
85c294b0940dbd97934cfdaee03946cbb382d1c7bb94296673bebbea98ee11b0

SHA512
970b91aef65890f721e74df5bcd1def1fc2735995779aae342f5843c36b8b35a2dfa2611b2117d550709a80705712588b818d1a7625fd4806fc3ed0090e793c5

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
289.4MB

MD5
494d3a23e8a0866f4e001c050a40e542

SHA1
8bc45c029f841713a592f763319d8bae11f0c7b2

SHA256
70ff08665dd4461872a0ac371d2beb22d32621cffc7ea7be0610fa007abdfd10

SHA512
073c64c84b7a5d4eed5d31044a48565a64b9d18b62b33a922a81e36171498d284e3e0def945ee28b8882becb26700c2f9b03f32c2d640d97ddee46f717c175a5

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
264.6MB

MD5
4f1ff6559cf55b65b3da6c4ec430ab4b

SHA1
3076661cf6838823cb8d3dc0e3041368eb3f0a7f

SHA256
43678248148020d5a86e0f7d67c173db0b02507d15e9149e90daaa90ed4951a1

SHA512
76a81dd04cf335b6f2b14c67edd8fe932fee9b3ca24abc726532b48848e0181c5c9c58ddbc11d41dd9b1288864aa646c77d117f7f38ec0bbc56575fc7bdd2665

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
265.8MB

MD5
3eb7eb351b6a9cdd68ba6d2afaf31295

SHA1
2f2fb4da1f06bace90b435019da9811cbc8cc71c

SHA256
c58f2acdae34b4827f91e8ea31bded8bb13cc93ed59a26a3f1ac8999a6b2be2d

SHA512
3b4e7a091baa7d25399ed5b2c3e72ba79c9c11fd9d9e831c703cc2f2e58d647019b7e0ba31d3255ea97d360d970c3db403e30617f199a1010297ec026d0d411b

Download Submit
memory/472-65-0x0000000000390000-0x0000000000B04000-memory.dmp

Filesize
7.5MB

Download
memory/472-66-0x0000000006220000-0x00000000065C0000-memory.dmp

Filesize
3.6MB

Download
memory/1716-56-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download
memory/1984-69-0x000000006F5E0000-0x000000006FB8B000-memory.dmp

Filesize
5.7MB

Download
memory/1984-70-0x000000006F5E0000-0x000000006FB8B000-memory.dmp

Filesize
5.7MB

Download
memory/1984-71-0x000000006F5E0000-0x000000006FB8B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing