purecrypter | 471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747

General

Target

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Size

3.6MB
MD5

36fd273ea7607d3a203f257f4e2649ed
SHA1

5e243f79ecb539d0d1f75fce7ddfedeccee70a48
SHA256

471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
SHA512

cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
SSDEEP

98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh

Score

10^/10

purecrypter downloader loader persistence

Malware Config

Signatures

Detect PureCrypter injector 1 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/1728-66-0x00000000063E0000-0x0000000006780000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Executes dropped EXE 2 IoCs

Processes:

voiceadequovl.exevoiceadequovl.exe

pid process

896 voiceadequovl.exe
1728 voiceadequovl.exe
Loads dropped DLL 4 IoCs

Processes:

voiceadequovl.exe

pid process

896 voiceadequovl.exe
896 voiceadequovl.exe
896 voiceadequovl.exe
896 voiceadequovl.exe

pid	process
896	voiceadequovl.exe
1728	voiceadequovl.exe

pid	process
896	voiceadequovl.exe
896	voiceadequovl.exe
896	voiceadequovl.exe
896	voiceadequovl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1832 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

voiceadequovl.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1728 voiceadequovl.exe
Token: SeDebugPrivilege 1832 powershell.exe

pid	process
1832	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1728	voiceadequovl.exe
Token: SeDebugPrivilege	1832	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.exe

description	pid	process	target process
PID 1460 wrote to memory of 896	1460	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 1460 wrote to memory of 896	1460	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 1460 wrote to memory of 896	1460	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 1460 wrote to memory of 896	1460	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 896 wrote to memory of 1728	896	voiceadequovl.exe	voiceadequovl.exe
PID 896 wrote to memory of 1728	896	voiceadequovl.exe	voiceadequovl.exe
PID 896 wrote to memory of 1728	896	voiceadequovl.exe	voiceadequovl.exe
PID 896 wrote to memory of 1728	896	voiceadequovl.exe	voiceadequovl.exe
PID 1728 wrote to memory of 1832	1728	voiceadequovl.exe	powershell.exe
PID 1728 wrote to memory of 1832	1728	voiceadequovl.exe	powershell.exe
PID 1728 wrote to memory of 1832	1728	voiceadequovl.exe	powershell.exe
PID 1728 wrote to memory of 1832	1728	voiceadequovl.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1460

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:896

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
Filesize
365.5MB

MD5
ba50f2bca86ba947a8d2035bb9b35123

SHA1
a542b5c5d41174dc2475a219978123b7d14f958f

SHA256
17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

SHA512
08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
Filesize
365.5MB

MD5
ba50f2bca86ba947a8d2035bb9b35123

SHA1
a542b5c5d41174dc2475a219978123b7d14f958f

SHA256
17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

SHA512
08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
221.7MB

MD5
1aa37d75611b998e2c24f0d21731146c

SHA1
caedf0fd7afbf2aaa6785edc628baa8a834503ad

SHA256
6d26d826a9103bdde8b97215d970f1c064a1177af1b94acdd9e84edb0dd9a2e6

SHA512
328e2559e62d8aea2687b4e10a1923c6e034d0d716d8dc9d271509fc493fe609d9fd574a9379e6ba9296852df648a07f3331ad5fcee34a1d1c6f566f5b0addf3

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
221.4MB

MD5
052fc684cba31eeaa2a59879dc205835

SHA1
3222fbf90809b23fcc4bf5149303b7bd84b84be9

SHA256
cffe8b95fc8d1080a7daff233a68ca59e37611414aab8c74a2274c94a35013c0

SHA512
b20f8fc1ea6466a4148a23f331c359dc66356285c4aae66546257029805e04dd2b5e74e37ad8556b4c195226dbdbc7564ffd7888c53b8ccd683bf269665a355e

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
203.6MB

MD5
45ddb3d0ebf9213ec618c79245850e7a

SHA1
a3ce325c551eedc374a2f349e261cdd209f13ade

SHA256
931bad8358892a9fdeba9851ee49f790a5209370217b276df90db546611e7f50

SHA512
3b4e68706bb4b1a21f5d76ec2620c478085fc075e05420dc2d2c195825ffa0749ec1f355f9c9eeb447c01656d104845371dafff10ba0be1ef6491fc24dfe1c16

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
219.0MB

MD5
78af152736ca9dfe41d185a56b0d267d

SHA1
0200fa3bed109c9dc28dc7d97aec24cffa1aa930

SHA256
c88c1488a45d50af9ae91a8c437ecbe7a7555842206d866b2c6f98bab02792df

SHA512
54a57d7abb173edb1d9f8597216672176714b9f256f6884a01f77060b24f0f7ea4d27d43b75de815a3182ba9b48273043f0a2a6bc3dea5ea5e93453e6ad1aecb

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
219.4MB

MD5
9cb098a53d84c205d9e0bf590e62a5d4

SHA1
9601e03ce1aece275db4d56b9737eb04a62931b1

SHA256
7d8d31833822a5e16004374c6449e9d90c1ce8a3526597d9f89608dbcb58e67a

SHA512
b8a135f86293d42f7cb0e612c46afd9d712a419b4e7f6853361cd1b447b5c0000de46d3f3941cd90b093fbd2521d6cd5642fcb0b544e2dd5fbee514e41b7b27e

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
227.4MB

MD5
3da72920e445a6ec7986c4c976a6ab43

SHA1
2a47b94cdf463bd1f450a5189c7cf6e86e8711bf

SHA256
ab14ee4db3a2368cd6a6265c0421c31bb0d2140ab60cacad6b6493e479b9dce2

SHA512
b73a9d479a8e29833c5c68eb6463cc28d6efd1e6f4b0f1ce179747b2665ba17f38ed8c682e7844703c6f5d148ea6757d9775d2e7993dbc108f7f92562e45231d

Download Submit
memory/896-56-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/896-54-0x0000000000000000-mapping.dmp

Download
memory/1728-62-0x0000000000000000-mapping.dmp

Download
memory/1728-65-0x0000000001220000-0x0000000001994000-memory.dmp

Filesize
7.5MB

Download
memory/1728-66-0x00000000063E0000-0x0000000006780000-memory.dmp

Filesize
3.6MB

Download
memory/1832-67-0x0000000000000000-mapping.dmp

Download
memory/1832-69-0x000000006FEF0000-0x000000007049B000-memory.dmp

Filesize
5.7MB

Download
memory/1832-70-0x000000006FEF0000-0x000000007049B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads