Analysis
-
max time kernel
148s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05-02-2023 07:06
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20220812-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
resource yara_rule behavioral1/memory/1728-66-0x00000000063E0000-0x0000000006780000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Executes dropped EXE 2 IoCs
pid Process 896 voiceadequovl.exe 1728 voiceadequovl.exe -
Loads dropped DLL 4 IoCs
pid Process 896 voiceadequovl.exe 896 voiceadequovl.exe 896 voiceadequovl.exe 896 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1832 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1728 voiceadequovl.exe Token: SeDebugPrivilege 1832 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1460 wrote to memory of 896 1460 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 1460 wrote to memory of 896 1460 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 1460 wrote to memory of 896 1460 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 1460 wrote to memory of 896 1460 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 896 wrote to memory of 1728 896 voiceadequovl.exe 29 PID 896 wrote to memory of 1728 896 voiceadequovl.exe 29 PID 896 wrote to memory of 1728 896 voiceadequovl.exe 29 PID 896 wrote to memory of 1728 896 voiceadequovl.exe 29 PID 1728 wrote to memory of 1832 1728 voiceadequovl.exe 30 PID 1728 wrote to memory of 1832 1728 voiceadequovl.exe 30 PID 1728 wrote to memory of 1832 1728 voiceadequovl.exe 30 PID 1728 wrote to memory of 1832 1728 voiceadequovl.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
Filesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
Filesize
221.7MB
MD51aa37d75611b998e2c24f0d21731146c
SHA1caedf0fd7afbf2aaa6785edc628baa8a834503ad
SHA2566d26d826a9103bdde8b97215d970f1c064a1177af1b94acdd9e84edb0dd9a2e6
SHA512328e2559e62d8aea2687b4e10a1923c6e034d0d716d8dc9d271509fc493fe609d9fd574a9379e6ba9296852df648a07f3331ad5fcee34a1d1c6f566f5b0addf3
-
Filesize
221.4MB
MD5052fc684cba31eeaa2a59879dc205835
SHA13222fbf90809b23fcc4bf5149303b7bd84b84be9
SHA256cffe8b95fc8d1080a7daff233a68ca59e37611414aab8c74a2274c94a35013c0
SHA512b20f8fc1ea6466a4148a23f331c359dc66356285c4aae66546257029805e04dd2b5e74e37ad8556b4c195226dbdbc7564ffd7888c53b8ccd683bf269665a355e
-
Filesize
203.6MB
MD545ddb3d0ebf9213ec618c79245850e7a
SHA1a3ce325c551eedc374a2f349e261cdd209f13ade
SHA256931bad8358892a9fdeba9851ee49f790a5209370217b276df90db546611e7f50
SHA5123b4e68706bb4b1a21f5d76ec2620c478085fc075e05420dc2d2c195825ffa0749ec1f355f9c9eeb447c01656d104845371dafff10ba0be1ef6491fc24dfe1c16
-
Filesize
219.0MB
MD578af152736ca9dfe41d185a56b0d267d
SHA10200fa3bed109c9dc28dc7d97aec24cffa1aa930
SHA256c88c1488a45d50af9ae91a8c437ecbe7a7555842206d866b2c6f98bab02792df
SHA51254a57d7abb173edb1d9f8597216672176714b9f256f6884a01f77060b24f0f7ea4d27d43b75de815a3182ba9b48273043f0a2a6bc3dea5ea5e93453e6ad1aecb
-
Filesize
219.4MB
MD59cb098a53d84c205d9e0bf590e62a5d4
SHA19601e03ce1aece275db4d56b9737eb04a62931b1
SHA2567d8d31833822a5e16004374c6449e9d90c1ce8a3526597d9f89608dbcb58e67a
SHA512b8a135f86293d42f7cb0e612c46afd9d712a419b4e7f6853361cd1b447b5c0000de46d3f3941cd90b093fbd2521d6cd5642fcb0b544e2dd5fbee514e41b7b27e
-
Filesize
227.4MB
MD53da72920e445a6ec7986c4c976a6ab43
SHA12a47b94cdf463bd1f450a5189c7cf6e86e8711bf
SHA256ab14ee4db3a2368cd6a6265c0421c31bb0d2140ab60cacad6b6493e479b9dce2
SHA512b73a9d479a8e29833c5c68eb6463cc28d6efd1e6f4b0f1ce179747b2665ba17f38ed8c682e7844703c6f5d148ea6757d9775d2e7993dbc108f7f92562e45231d