Analysis

  • max time kernel
    148s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    05-02-2023 07:06

General

  • Target

    5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

  • Size

    3.6MB

  • MD5

    36fd273ea7607d3a203f257f4e2649ed

  • SHA1

    5e243f79ecb539d0d1f75fce7ddfedeccee70a48

  • SHA256

    471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747

  • SHA512

    cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d

  • SSDEEP

    98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh

Malware Config

Signatures

  • Detect PureCrypter injector 1 IoCs
  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
    "C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:896
      • C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
        "C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1832

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

    Filesize

    365.5MB

    MD5

    ba50f2bca86ba947a8d2035bb9b35123

    SHA1

    a542b5c5d41174dc2475a219978123b7d14f958f

    SHA256

    17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

    SHA512

    08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

    Filesize

    365.5MB

    MD5

    ba50f2bca86ba947a8d2035bb9b35123

    SHA1

    a542b5c5d41174dc2475a219978123b7d14f958f

    SHA256

    17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

    SHA512

    08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

  • C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

    Filesize

    221.7MB

    MD5

    1aa37d75611b998e2c24f0d21731146c

    SHA1

    caedf0fd7afbf2aaa6785edc628baa8a834503ad

    SHA256

    6d26d826a9103bdde8b97215d970f1c064a1177af1b94acdd9e84edb0dd9a2e6

    SHA512

    328e2559e62d8aea2687b4e10a1923c6e034d0d716d8dc9d271509fc493fe609d9fd574a9379e6ba9296852df648a07f3331ad5fcee34a1d1c6f566f5b0addf3

  • C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

    Filesize

    221.4MB

    MD5

    052fc684cba31eeaa2a59879dc205835

    SHA1

    3222fbf90809b23fcc4bf5149303b7bd84b84be9

    SHA256

    cffe8b95fc8d1080a7daff233a68ca59e37611414aab8c74a2274c94a35013c0

    SHA512

    b20f8fc1ea6466a4148a23f331c359dc66356285c4aae66546257029805e04dd2b5e74e37ad8556b4c195226dbdbc7564ffd7888c53b8ccd683bf269665a355e

  • \Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

    Filesize

    203.6MB

    MD5

    45ddb3d0ebf9213ec618c79245850e7a

    SHA1

    a3ce325c551eedc374a2f349e261cdd209f13ade

    SHA256

    931bad8358892a9fdeba9851ee49f790a5209370217b276df90db546611e7f50

    SHA512

    3b4e68706bb4b1a21f5d76ec2620c478085fc075e05420dc2d2c195825ffa0749ec1f355f9c9eeb447c01656d104845371dafff10ba0be1ef6491fc24dfe1c16

  • \Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

    Filesize

    219.0MB

    MD5

    78af152736ca9dfe41d185a56b0d267d

    SHA1

    0200fa3bed109c9dc28dc7d97aec24cffa1aa930

    SHA256

    c88c1488a45d50af9ae91a8c437ecbe7a7555842206d866b2c6f98bab02792df

    SHA512

    54a57d7abb173edb1d9f8597216672176714b9f256f6884a01f77060b24f0f7ea4d27d43b75de815a3182ba9b48273043f0a2a6bc3dea5ea5e93453e6ad1aecb

  • \Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

    Filesize

    219.4MB

    MD5

    9cb098a53d84c205d9e0bf590e62a5d4

    SHA1

    9601e03ce1aece275db4d56b9737eb04a62931b1

    SHA256

    7d8d31833822a5e16004374c6449e9d90c1ce8a3526597d9f89608dbcb58e67a

    SHA512

    b8a135f86293d42f7cb0e612c46afd9d712a419b4e7f6853361cd1b447b5c0000de46d3f3941cd90b093fbd2521d6cd5642fcb0b544e2dd5fbee514e41b7b27e

  • \Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

    Filesize

    227.4MB

    MD5

    3da72920e445a6ec7986c4c976a6ab43

    SHA1

    2a47b94cdf463bd1f450a5189c7cf6e86e8711bf

    SHA256

    ab14ee4db3a2368cd6a6265c0421c31bb0d2140ab60cacad6b6493e479b9dce2

    SHA512

    b73a9d479a8e29833c5c68eb6463cc28d6efd1e6f4b0f1ce179747b2665ba17f38ed8c682e7844703c6f5d148ea6757d9775d2e7993dbc108f7f92562e45231d

  • memory/896-56-0x0000000075D01000-0x0000000075D03000-memory.dmp

    Filesize

    8KB

  • memory/1728-65-0x0000000001220000-0x0000000001994000-memory.dmp

    Filesize

    7.5MB

  • memory/1728-66-0x00000000063E0000-0x0000000006780000-memory.dmp

    Filesize

    3.6MB

  • memory/1832-69-0x000000006FEF0000-0x000000007049B000-memory.dmp

    Filesize

    5.7MB

  • memory/1832-70-0x000000006FEF0000-0x000000007049B000-memory.dmp

    Filesize

    5.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.