Analysis
-
max time kernel
79s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-02-2023 07:35
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20221111-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Detect PureCrypter injector 1 IoCs
resource yara_rule behavioral1/memory/952-66-0x0000000006420000-0x00000000067C0000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Executes dropped EXE 4 IoCs
pid Process 1988 voiceadequovl.exe 952 voiceadequovl.exe 1944 voiceadequovl.exe 472 voiceadequovl.exe -
Loads dropped DLL 4 IoCs
pid Process 1988 voiceadequovl.exe 1988 voiceadequovl.exe 1988 voiceadequovl.exe 1988 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 952 set thread context of 472 952 voiceadequovl.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1184 powershell.exe 952 voiceadequovl.exe 952 voiceadequovl.exe 1000 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 952 voiceadequovl.exe Token: SeDebugPrivilege 1184 powershell.exe Token: SeDebugPrivilege 1000 powershell.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1628 wrote to memory of 1988 1628 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 1628 wrote to memory of 1988 1628 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 1628 wrote to memory of 1988 1628 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 1628 wrote to memory of 1988 1628 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 1988 wrote to memory of 952 1988 voiceadequovl.exe 29 PID 1988 wrote to memory of 952 1988 voiceadequovl.exe 29 PID 1988 wrote to memory of 952 1988 voiceadequovl.exe 29 PID 1988 wrote to memory of 952 1988 voiceadequovl.exe 29 PID 952 wrote to memory of 1184 952 voiceadequovl.exe 30 PID 952 wrote to memory of 1184 952 voiceadequovl.exe 30 PID 952 wrote to memory of 1184 952 voiceadequovl.exe 30 PID 952 wrote to memory of 1184 952 voiceadequovl.exe 30 PID 952 wrote to memory of 1636 952 voiceadequovl.exe 32 PID 952 wrote to memory of 1636 952 voiceadequovl.exe 32 PID 952 wrote to memory of 1636 952 voiceadequovl.exe 32 PID 952 wrote to memory of 1636 952 voiceadequovl.exe 32 PID 1636 wrote to memory of 1000 1636 cmd.exe 34 PID 1636 wrote to memory of 1000 1636 cmd.exe 34 PID 1636 wrote to memory of 1000 1636 cmd.exe 34 PID 1636 wrote to memory of 1000 1636 cmd.exe 34 PID 952 wrote to memory of 1944 952 voiceadequovl.exe 35 PID 952 wrote to memory of 1944 952 voiceadequovl.exe 35 PID 952 wrote to memory of 1944 952 voiceadequovl.exe 35 PID 952 wrote to memory of 1944 952 voiceadequovl.exe 35 PID 952 wrote to memory of 472 952 voiceadequovl.exe 36 PID 952 wrote to memory of 472 952 voiceadequovl.exe 36 PID 952 wrote to memory of 472 952 voiceadequovl.exe 36 PID 952 wrote to memory of 472 952 voiceadequovl.exe 36 PID 952 wrote to memory of 472 952 voiceadequovl.exe 36 PID 952 wrote to memory of 472 952 voiceadequovl.exe 36 PID 952 wrote to memory of 472 952 voiceadequovl.exe 36 PID 952 wrote to memory of 472 952 voiceadequovl.exe 36 PID 952 wrote to memory of 472 952 voiceadequovl.exe 36 PID 952 wrote to memory of 472 952 voiceadequovl.exe 36 PID 952 wrote to memory of 472 952 voiceadequovl.exe 36 PID 952 wrote to memory of 472 952 voiceadequovl.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
PID:1944
-
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
PID:472 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵PID:1816
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵PID:1592
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵PID:1376
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵PID:1924
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵PID:1912
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
315.4MB
MD555ae0c04cc546d3e5235846f86c25388
SHA185de1f2ce17361036eb78552d9bf56865021807a
SHA2568fb7c2f4a9e74e06f360a1c67fa191e50d5640da1c303233d7a5120912db19d4
SHA512fad2792d7164430749afbec53721d7a86f2b21bc351e7b75bd690e1aa6b16556c6798e81bbde3d6048117cca2d1a275e9bf39dd41414e8b88df915d1b51140ba
-
Filesize
307.9MB
MD5cff1507835bfab500a2246e9116d9ec1
SHA1b9fe88dd29135b09f18130155cc7e7e7c02bd68e
SHA25609c21185a07456305e43f8aad5819a3dc9ec5a5b1711c96e9e6f6b69d6d8a5e0
SHA512d41ee00c581b837db013ae25ef5b170d307319f2595ce733bf9ec42f5b1b98f374de9b89f4c610a490faf90f833f53aca0baa341eebcb07ee3b5aab2fadc80bb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD51ccbcd2a6be3018f4544ebbe2c5a075e
SHA1272045061f79e0e90fe7e1babf0f37acda71bdbb
SHA256105b80f20732622495f3b50504f43c82bca393e9ce82a18f5c20c0b9213f8aa6
SHA5127f305cf7a6ed0e45ba9490dcc940b4f9a945e0c4ceece539f93be8fdeb0344357cc7d565f60b9bd7ac022d89d5944b4697f21434d8005f565edf11294626973e
-
Filesize
193.0MB
MD58bac2afd16a17bf428e35295cc47c9db
SHA146fa2a38694fd9853c3700f15fc058789d6a8334
SHA256098097e59c2df893fb5c58646f1c6a65ea8e53214423d1eec879a7c330eaa0e2
SHA512f642f289121cdbe17c358af7207d02b91de27d5d4a92954d48f82acee1fd4294067d243873f9d05472b95e0c3adb73b1997109262988b737d78b1bc168647252
-
Filesize
205.0MB
MD532e69bc883fa5176bd126ecca0e1c3f9
SHA1b52ba24550e13104af8c86100180e0253ea2d2b9
SHA256eb5b7716ccbaf215a4fc7c42e1b8ad39c7235b1eefc3bf0e17264d26eabbe254
SHA51273ed427c468dec9dddb49c883d302028cbfebe7267b4d7353e50bf7bf3bf301efdfa16e38f66a0ec74997dc4a98dd675b249c6b241ff18cefe23e368a337ea7d
-
Filesize
106.6MB
MD5ef5b458d38cd1e4bbbf42a079fcbf1fa
SHA1a32b3f3202fffbe8a7a5474fc483b7f1fd8c25bd
SHA2561cba31a5e4efcf1e639683ce600df2ef1ddea2d858f32bfc1b0d499323bb9878
SHA51228c6571260af0c7c0c235dfb58a331e28b7fb2b050b53e8485f52c362ee2a8193c5db123d23bc64ef2473df8b8baececd55e21fae24612f1904a834d498f7661
-
Filesize
105.8MB
MD5bde91f83ecb1a3ff3eca94f89d40213a
SHA18949734438c9f53c850e375b37d8e8d2aeee4c4d
SHA2562d024133fd4f7f813edc81df12b0a23ee3a5c7b31c2f2d7d9aca2478fb74cde5
SHA512b211e0e93c43efcc254b6aa866f8b10a334409b0b739dc173e32e575414bdc8d5e53d28e7cf623d99022f6d79c9460bc9c7b1f65a60a8a5603bf76e652a533f4
-
Filesize
206.3MB
MD5c2d84e22c1db292437084b8633d6adc0
SHA14d58ff1292b9cc3a0150ed777c7040e09518e3e5
SHA256bc42d9ccb973ef3c922b501abb43684db727d7b30115368c9bc2921c764e3097
SHA512f2a62bdc8d32e77e430135f71339cf69f813368246966527c5f7400087be3a9ac9674ae7b0f7b677835401cbc153cd0091b4dcf89c7a3ccf38c09db9c80f5767
-
Filesize
206.9MB
MD5bf179ba2a2ab083755fb65210673cecc
SHA1484747b441744010d7e10dbcd67cbe4ee79ce43a
SHA25657ef8678be679765c06034b54b9b21925a856512cfcc8abef0f5dd3817c6914a
SHA512c220d5c92104226792ea742487c451ce2471885608a7bac0f8ef813129e32673bfb098f160e916019e13151806399db8ca2803ee706ab414327995dd0ec6d51f
-
Filesize
176.7MB
MD5b1375748973702cd90c9e658871e5466
SHA1b15b986770dca95128451ba60484436dc8f40975
SHA256c30f498b8713fc46bb28255ed7e89e5c86f99c0ceb642af02b2c43e8af5f572d
SHA51239aa4446389253710bcf11757b93432dc2f009b8ed9f28674db49814948ca60854acfe3fd3ed92a8b0a37cfeccfed329ed7099d85fa9124c715c99f6bb171a8b
-
Filesize
191.2MB
MD543c5c4e26f7ae2f753840abeba09ca73
SHA1b42e2111ca494856581c2ac4cc2288445eb7a82e
SHA256fecbb6dce3f4f17b12202e49dcc0e2982bde7f7c90a91f735f174d8850090ac8
SHA51248c3db06a179b7f8c8d30140f7ea60392ad6f822f5871a8a994cde82beedd76b9c911231370de844fe198a745e23e8acf06d6d8afaab338af7ee2d8749d77045