Analysis
-
max time kernel
79s -
max time network
83s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-02-2023 13:16
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20221111-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/912-66-0x00000000064B0000-0x0000000006850000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Executes dropped EXE 3 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exevoiceadequovl.exepid process 1324 voiceadequovl.exe 912 voiceadequovl.exe 1776 voiceadequovl.exe -
Loads dropped DLL 4 IoCs
Processes:
voiceadequovl.exepid process 1324 voiceadequovl.exe 1324 voiceadequovl.exe 1324 voiceadequovl.exe 1324 voiceadequovl.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
voiceadequovl.exedescription pid process target process PID 912 set thread context of 1776 912 voiceadequovl.exe voiceadequovl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 304 powershell.exe 240 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
voiceadequovl.exepowershell.exepowershell.exewmic.exeWMIC.exedescription pid process Token: SeDebugPrivilege 912 voiceadequovl.exe Token: SeDebugPrivilege 304 powershell.exe Token: SeDebugPrivilege 240 powershell.exe Token: SeIncreaseQuotaPrivilege 1992 wmic.exe Token: SeSecurityPrivilege 1992 wmic.exe Token: SeTakeOwnershipPrivilege 1992 wmic.exe Token: SeLoadDriverPrivilege 1992 wmic.exe Token: SeSystemProfilePrivilege 1992 wmic.exe Token: SeSystemtimePrivilege 1992 wmic.exe Token: SeProfSingleProcessPrivilege 1992 wmic.exe Token: SeIncBasePriorityPrivilege 1992 wmic.exe Token: SeCreatePagefilePrivilege 1992 wmic.exe Token: SeBackupPrivilege 1992 wmic.exe Token: SeRestorePrivilege 1992 wmic.exe Token: SeShutdownPrivilege 1992 wmic.exe Token: SeDebugPrivilege 1992 wmic.exe Token: SeSystemEnvironmentPrivilege 1992 wmic.exe Token: SeRemoteShutdownPrivilege 1992 wmic.exe Token: SeUndockPrivilege 1992 wmic.exe Token: SeManageVolumePrivilege 1992 wmic.exe Token: 33 1992 wmic.exe Token: 34 1992 wmic.exe Token: 35 1992 wmic.exe Token: SeIncreaseQuotaPrivilege 1992 wmic.exe Token: SeSecurityPrivilege 1992 wmic.exe Token: SeTakeOwnershipPrivilege 1992 wmic.exe Token: SeLoadDriverPrivilege 1992 wmic.exe Token: SeSystemProfilePrivilege 1992 wmic.exe Token: SeSystemtimePrivilege 1992 wmic.exe Token: SeProfSingleProcessPrivilege 1992 wmic.exe Token: SeIncBasePriorityPrivilege 1992 wmic.exe Token: SeCreatePagefilePrivilege 1992 wmic.exe Token: SeBackupPrivilege 1992 wmic.exe Token: SeRestorePrivilege 1992 wmic.exe Token: SeShutdownPrivilege 1992 wmic.exe Token: SeDebugPrivilege 1992 wmic.exe Token: SeSystemEnvironmentPrivilege 1992 wmic.exe Token: SeRemoteShutdownPrivilege 1992 wmic.exe Token: SeUndockPrivilege 1992 wmic.exe Token: SeManageVolumePrivilege 1992 wmic.exe Token: 33 1992 wmic.exe Token: 34 1992 wmic.exe Token: 35 1992 wmic.exe Token: SeIncreaseQuotaPrivilege 1564 WMIC.exe Token: SeSecurityPrivilege 1564 WMIC.exe Token: SeTakeOwnershipPrivilege 1564 WMIC.exe Token: SeLoadDriverPrivilege 1564 WMIC.exe Token: SeSystemProfilePrivilege 1564 WMIC.exe Token: SeSystemtimePrivilege 1564 WMIC.exe Token: SeProfSingleProcessPrivilege 1564 WMIC.exe Token: SeIncBasePriorityPrivilege 1564 WMIC.exe Token: SeCreatePagefilePrivilege 1564 WMIC.exe Token: SeBackupPrivilege 1564 WMIC.exe Token: SeRestorePrivilege 1564 WMIC.exe Token: SeShutdownPrivilege 1564 WMIC.exe Token: SeDebugPrivilege 1564 WMIC.exe Token: SeSystemEnvironmentPrivilege 1564 WMIC.exe Token: SeRemoteShutdownPrivilege 1564 WMIC.exe Token: SeUndockPrivilege 1564 WMIC.exe Token: SeManageVolumePrivilege 1564 WMIC.exe Token: 33 1564 WMIC.exe Token: 34 1564 WMIC.exe Token: 35 1564 WMIC.exe Token: SeIncreaseQuotaPrivilege 1564 WMIC.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exevoiceadequovl.execmd.execmd.exedescription pid process target process PID 2012 wrote to memory of 1324 2012 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 2012 wrote to memory of 1324 2012 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 2012 wrote to memory of 1324 2012 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 2012 wrote to memory of 1324 2012 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1324 wrote to memory of 912 1324 voiceadequovl.exe voiceadequovl.exe PID 1324 wrote to memory of 912 1324 voiceadequovl.exe voiceadequovl.exe PID 1324 wrote to memory of 912 1324 voiceadequovl.exe voiceadequovl.exe PID 1324 wrote to memory of 912 1324 voiceadequovl.exe voiceadequovl.exe PID 912 wrote to memory of 304 912 voiceadequovl.exe powershell.exe PID 912 wrote to memory of 304 912 voiceadequovl.exe powershell.exe PID 912 wrote to memory of 304 912 voiceadequovl.exe powershell.exe PID 912 wrote to memory of 304 912 voiceadequovl.exe powershell.exe PID 912 wrote to memory of 1712 912 voiceadequovl.exe cmd.exe PID 912 wrote to memory of 1712 912 voiceadequovl.exe cmd.exe PID 912 wrote to memory of 1712 912 voiceadequovl.exe cmd.exe PID 912 wrote to memory of 1712 912 voiceadequovl.exe cmd.exe PID 1712 wrote to memory of 240 1712 cmd.exe powershell.exe PID 1712 wrote to memory of 240 1712 cmd.exe powershell.exe PID 1712 wrote to memory of 240 1712 cmd.exe powershell.exe PID 1712 wrote to memory of 240 1712 cmd.exe powershell.exe PID 912 wrote to memory of 1776 912 voiceadequovl.exe voiceadequovl.exe PID 912 wrote to memory of 1776 912 voiceadequovl.exe voiceadequovl.exe PID 912 wrote to memory of 1776 912 voiceadequovl.exe voiceadequovl.exe PID 912 wrote to memory of 1776 912 voiceadequovl.exe voiceadequovl.exe PID 912 wrote to memory of 1776 912 voiceadequovl.exe voiceadequovl.exe PID 912 wrote to memory of 1776 912 voiceadequovl.exe voiceadequovl.exe PID 912 wrote to memory of 1776 912 voiceadequovl.exe voiceadequovl.exe PID 912 wrote to memory of 1776 912 voiceadequovl.exe voiceadequovl.exe PID 912 wrote to memory of 1776 912 voiceadequovl.exe voiceadequovl.exe PID 912 wrote to memory of 1776 912 voiceadequovl.exe voiceadequovl.exe PID 912 wrote to memory of 1776 912 voiceadequovl.exe voiceadequovl.exe PID 912 wrote to memory of 1776 912 voiceadequovl.exe voiceadequovl.exe PID 1776 wrote to memory of 1992 1776 voiceadequovl.exe wmic.exe PID 1776 wrote to memory of 1992 1776 voiceadequovl.exe wmic.exe PID 1776 wrote to memory of 1992 1776 voiceadequovl.exe wmic.exe PID 1776 wrote to memory of 1992 1776 voiceadequovl.exe wmic.exe PID 1776 wrote to memory of 2036 1776 voiceadequovl.exe cmd.exe PID 1776 wrote to memory of 2036 1776 voiceadequovl.exe cmd.exe PID 1776 wrote to memory of 2036 1776 voiceadequovl.exe cmd.exe PID 1776 wrote to memory of 2036 1776 voiceadequovl.exe cmd.exe PID 2036 wrote to memory of 1564 2036 cmd.exe WMIC.exe PID 2036 wrote to memory of 1564 2036 cmd.exe WMIC.exe PID 2036 wrote to memory of 1564 2036 cmd.exe WMIC.exe PID 2036 wrote to memory of 1564 2036 cmd.exe WMIC.exe PID 1776 wrote to memory of 1648 1776 voiceadequovl.exe cmd.exe PID 1776 wrote to memory of 1648 1776 voiceadequovl.exe cmd.exe PID 1776 wrote to memory of 1648 1776 voiceadequovl.exe cmd.exe PID 1776 wrote to memory of 1648 1776 voiceadequovl.exe cmd.exe PID 1648 wrote to memory of 1580 1648 cmd.exe WMIC.exe PID 1648 wrote to memory of 1580 1648 cmd.exe WMIC.exe PID 1648 wrote to memory of 1580 1648 cmd.exe WMIC.exe PID 1648 wrote to memory of 1580 1648 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
185.0MB
MD5bf9bd28054bbeb5a25fb32b4972d7214
SHA13ca243291ab673c4016475df554a1c3e638c07bc
SHA2562af78b75bf469ff6fa82bd08714dc962a71f68a02b71508ebb92ca85bee3be4b
SHA512dce57f04d0a120c03ea467f066d23a03065355d1bbcebf3e26187a9d78e2a2b8fc752e875784dd0d88712992665060d29e63ae6d36ee7f0f39e7dc6654db1939
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
181.8MB
MD56336dc43809b3a8d622c0b563fe57fc5
SHA1e8795273f8a563ef2fb017cc13560f422afebbb3
SHA2568cee8b2088127980dea5b74f1eac6faac1c73bffe069972a6b0629fc21349574
SHA5128bcfb8f00f532c41dbad1a3622685eb76a4e105041d37a7ad80cd69d6d0bc2e366adde85d53b51cc266d7446e5ab6f536e5e8d509c39ddff7003356656b9310b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD532b447e1a2f7be76cf32e3cd91a61852
SHA1e774d775f295a9cf80604250900f5b4347688555
SHA25655877232c9e65977ec7a7e140df7e515b04481293771c25e9885eb8c2e656124
SHA5120fd83bf9c70e170182044098a716dedc8f1cd14c9d2db4e6734290010d5ac01ac6ef83313ff1ba560cd34db8cf468d62a105d0f05e86f60ad9031adeb1768778
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
174.2MB
MD5922337c74955b8e68da4c472065311e1
SHA193c64db075dec27fd06babe5c26cfbaf7cc54f32
SHA256ea08e133a62d1f5f360ae8c54f19c4b67b3079e0e0edc3b3c63287586123d805
SHA512c3b26c34dc220f3e264d8cedd6ac197497f61ff6f9ee955587639c4fc63f01389bd6215373ff97f1aec71e03df8c8e065c465cd0d76fa7c43e1b99f1e0aed0b3
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
178.2MB
MD53d7dde2cdf26f939dd1d3c0246bb915c
SHA187883de597fa999ecaa79b86717b49c0ddce79c2
SHA256a7ccdce93cf240b6a9ae76a0712255a550fb800f93797aa0f2591e9f56f0c170
SHA512c5f18a7260394bf9636f7255cdd42d155cd6d529a9b32e7344a09eea027d39f93ba7ad082d4d5973a459a879d03b6108c1853da272109e430f3c0863b5ef1a58
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
102.4MB
MD51ec650b5440db7b987d3433d6bc66397
SHA1a81addde74f31f44952c64738eaae05a47488cf0
SHA2563b7cfef4e603f6ff27b323ae562e52daacb896b0b48edafb3cb854b545d7f28e
SHA512828c9260c2292164aa44d0e95090e6c3a8fae8024f9f1edd6c0468517ebdf59afead911e4334ffa7ddc580a8593f343278f73eab3374a11b86804da404999d12
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
174.7MB
MD59bf2388db1f305e519662cc3d4eba454
SHA1b370d8aa93a58b9ada60d83a45d10d9d03bc3e8c
SHA2568f712eed16df0ef74728157bfbae899ea32d2fea770679ccb2e2f39f81330184
SHA512035e7453342b6adae19c99cc6a0b50fb9c8d1c0b7c37c82129fb58a69b96fa6a8f1b0742285031390645b22094645a328ffeef3c759b648451a2d77b5bb983a1
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
175.6MB
MD56e1448446a800d8a68499b3e24106d8d
SHA1f95426df9461c15d6900ce7f540eb5e6e55a9b27
SHA256cad765949cbd8e49610a4f3e84d5656b3154d4ced789761afeae16418fea9bb4
SHA512a82920a00707bf43f87c9b5d7e5a3711e1550c0ab1fb0dba169f4d220f2335e256ad9e0be9df9347a3de8bf80b5d872ceba89ccaeb2ad92056fc0287c7b74743
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
172.9MB
MD5028cb6d430cb1562a0dceaad81be77b1
SHA165e4f71537c2dcd2d7e4feecd900c740e66cfabb
SHA256b1d3e246e85d2134da097e8f514a38fe31d75e849e206fcc7ebc948e295c9fe1
SHA51260cb5dfd37e9b99322894dab9365b153fe686a20fe1f7a6784a3f0ce53037fbbcefb2ffe31a6c466236037146793298b074e4e1200af1f7dd864daec06b08597
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
176.4MB
MD509b2a65d66e03e86b4fe8d39fcb58347
SHA1eaf3e6fac73499d59624d703dccb1a19c9df3529
SHA25694b33338fda5409802f85c9f5591358767bb83a56636b2b4c8134e0e4e88f8aa
SHA51207befd09d066875505c357f458d7480537a8e1fda73f7aa2e4ee9eb86724466f60cb08c1496f90cbe8609e7a226b3f650a66e82d1fc8c5a3d928efea1130cc6e
-
memory/240-78-0x000000006F560000-0x000000006FB0B000-memory.dmpFilesize
5.7MB
-
memory/240-94-0x000000006F560000-0x000000006FB0B000-memory.dmpFilesize
5.7MB
-
memory/240-73-0x0000000000000000-mapping.dmp
-
memory/304-67-0x0000000000000000-mapping.dmp
-
memory/304-69-0x000000006F5B0000-0x000000006FB5B000-memory.dmpFilesize
5.7MB
-
memory/304-70-0x000000006F5B0000-0x000000006FB5B000-memory.dmpFilesize
5.7MB
-
memory/304-71-0x000000006F5B0000-0x000000006FB5B000-memory.dmpFilesize
5.7MB
-
memory/912-66-0x00000000064B0000-0x0000000006850000-memory.dmpFilesize
3.6MB
-
memory/912-74-0x00000000052C0000-0x0000000005432000-memory.dmpFilesize
1.4MB
-
memory/912-65-0x00000000008A0000-0x0000000001014000-memory.dmpFilesize
7.5MB
-
memory/912-62-0x0000000000000000-mapping.dmp
-
memory/1324-56-0x0000000075E81000-0x0000000075E83000-memory.dmpFilesize
8KB
-
memory/1324-54-0x0000000000000000-mapping.dmp
-
memory/1564-98-0x0000000000000000-mapping.dmp
-
memory/1580-100-0x0000000000000000-mapping.dmp
-
memory/1648-99-0x0000000000000000-mapping.dmp
-
memory/1712-72-0x0000000000000000-mapping.dmp
-
memory/1776-89-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1776-95-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1776-81-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1776-90-0x0000000000464C20-mapping.dmp
-
memory/1776-83-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1776-93-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1776-77-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1776-88-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1776-101-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1776-79-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1776-86-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1776-85-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1992-96-0x0000000000000000-mapping.dmp
-
memory/2036-97-0x0000000000000000-mapping.dmp