Analysis
-
max time kernel
136s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05-02-2023 13:17
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20221111-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/832-66-0x0000000006490000-0x0000000006830000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Executes dropped EXE 2 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exepid process 1628 voiceadequovl.exe 832 voiceadequovl.exe -
Loads dropped DLL 4 IoCs
Processes:
voiceadequovl.exepid process 1628 voiceadequovl.exe 1628 voiceadequovl.exe 1628 voiceadequovl.exe 1628 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1348 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
voiceadequovl.exepowershell.exedescription pid process Token: SeDebugPrivilege 832 voiceadequovl.exe Token: SeDebugPrivilege 1348 powershell.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exedescription pid process target process PID 1588 wrote to memory of 1628 1588 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1588 wrote to memory of 1628 1588 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1588 wrote to memory of 1628 1588 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1588 wrote to memory of 1628 1588 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1628 wrote to memory of 832 1628 voiceadequovl.exe voiceadequovl.exe PID 1628 wrote to memory of 832 1628 voiceadequovl.exe voiceadequovl.exe PID 1628 wrote to memory of 832 1628 voiceadequovl.exe voiceadequovl.exe PID 1628 wrote to memory of 832 1628 voiceadequovl.exe voiceadequovl.exe PID 832 wrote to memory of 1348 832 voiceadequovl.exe powershell.exe PID 832 wrote to memory of 1348 832 voiceadequovl.exe powershell.exe PID 832 wrote to memory of 1348 832 voiceadequovl.exe powershell.exe PID 832 wrote to memory of 1348 832 voiceadequovl.exe powershell.exe PID 832 wrote to memory of 808 832 voiceadequovl.exe cmd.exe PID 832 wrote to memory of 808 832 voiceadequovl.exe cmd.exe PID 832 wrote to memory of 808 832 voiceadequovl.exe cmd.exe PID 832 wrote to memory of 808 832 voiceadequovl.exe cmd.exe PID 832 wrote to memory of 1960 832 voiceadequovl.exe voiceadequovl.exe PID 832 wrote to memory of 1960 832 voiceadequovl.exe voiceadequovl.exe PID 832 wrote to memory of 1960 832 voiceadequovl.exe voiceadequovl.exe PID 832 wrote to memory of 1960 832 voiceadequovl.exe voiceadequovl.exe PID 832 wrote to memory of 1960 832 voiceadequovl.exe voiceadequovl.exe PID 832 wrote to memory of 1960 832 voiceadequovl.exe voiceadequovl.exe PID 808 wrote to memory of 1496 808 cmd.exe powershell.exe PID 808 wrote to memory of 1496 808 cmd.exe powershell.exe PID 808 wrote to memory of 1496 808 cmd.exe powershell.exe PID 808 wrote to memory of 1496 808 cmd.exe powershell.exe PID 832 wrote to memory of 1960 832 voiceadequovl.exe voiceadequovl.exe PID 832 wrote to memory of 1960 832 voiceadequovl.exe voiceadequovl.exe PID 832 wrote to memory of 1960 832 voiceadequovl.exe voiceadequovl.exe PID 832 wrote to memory of 1960 832 voiceadequovl.exe voiceadequovl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
272.3MB
MD5a88a066df6b71dffac30abac7d9e8111
SHA12929af98bd21b317e1df79184a3a86f29ed7a833
SHA2561ec3cd569d55ac66eef6e86fac292b12360d61c6dc6823cf8f49989b628db95f
SHA5126abe9da8af4be35a31e8a0244c3958c52e83529eca4d3fc666c196b8a809b9e7ad3592bdc509d12f6b4b1a6f2da9762fb975faf1ec97f4667672402e8edab7d8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5cb5f11028b71466ec7a8c859c98cc768
SHA181f6d9406e6755420d09ad2dc3512fc139bcd7c0
SHA2562eb661ad31255ca7a68344921a1ff667eb274a44f9097ad59a09135f305f571e
SHA512a584eaa00dadfe8a254e061b68f065fec08f8e2851e6d943b40c9c7e644012aea0ab79c5595d58fb3c9ac8c66d6c4c70b0272c142bb7da2f2504ac9a9aa2212d
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
245.3MB
MD56df8a7c398280fae83ffc78316e1e2a9
SHA156b8830df9276c7f668aea0e95332b37d8e626bd
SHA256f420dfff87bf1fdc0574c608ca86cfdcc79f4bbeb885258ce2dd405ef681c819
SHA51264017d6351e48bf142442a07e3cfbed3edbbfa2830a5e5be0b80f767daa18aab8576e00d7c053b6b81e246bc5872e5219852dc517bad532aaa741031acd98a04
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
253.3MB
MD5311a0d49d40192a44e4026cfcc02a1e7
SHA1a5ab5aa08a0492d53da33943d41a037e6af649d1
SHA2564380fc5b62c8dd253fad69652d90178baa1327ab5cc5fdfb21ad4e1ebb588a0e
SHA51211054d8c5cf2e1af704d9ce536dcb7bcec0f4281b7b73cdb9f56c74433ce600e3b0e00a54aa749ad63965e1753396bbbccd4092429086bd38bcc6b2d597fe6c0
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
22.3MB
MD5d152e1ec8832b541597daa6b88c9218a
SHA140c257d3c7fe1f126ad404162c827499b7a66b01
SHA25609efd07c90e04db394619f36c542aa504e19677cd31e082b220fece5a577a4c0
SHA5128ea83428aef5c8a2a9fc84202d04de2a88d4f690ddabc89c55a2f656c1935070db343773388c15f2fbde52863a4e735847b17beaefbe73b19083c48ce4006846
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
255.6MB
MD5f3c09b41dc200fb7b9eb1e28e70120fc
SHA1aa1bae5f3dd36737a97338eeda9e53a7fa6f26f3
SHA2566ff79ebc8ceb85f3f7f9d8b5c119dc78604e07b6e295f7fb7fd6a3658d48c355
SHA51218e7efc6468c14d9cf5cf26972c29c1b4c0842c09a2682d2b993f432b92b4b989e88f353f44d95ab0d7f5c69c8ee5f9ff361c67f74c0728c55c1707292d1b675
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
254.3MB
MD5d16f80af545d4b26037d1fb5063aa5d9
SHA144219023fb5da315fc79b7bca6ae6dda40c88d73
SHA2563e3437a7f2401ced7c1ed2365e6bb34f94450e05477e1a1a03bfc2cce91ff41f
SHA512d176cdba63df6f35cffa1e9df82b55ff4e81fd3b197f4ea03baca9fcbb11b0685671fd00ffea506d6be832a7804663962e0cbafcd3061bf955bb51fa9d072223
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
255.1MB
MD58686322b4ecf8ed7c7192bf4d2a98946
SHA1d1bc832f7e0d0efc8813a27aa6b710c6147fc51d
SHA25659e14a35ba4767d6f1f363ce5192b427215b44618e1be9e2a34018e5507d7cfb
SHA512c53e2ac301dae570544db66f613c141e058e3bee07cd2e1cffe958d3a76fff9bc040266d4a0064d9badae860f0543d72d904ea37f9215c2b5940f4fff27bf3d0
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
255.1MB
MD58686322b4ecf8ed7c7192bf4d2a98946
SHA1d1bc832f7e0d0efc8813a27aa6b710c6147fc51d
SHA25659e14a35ba4767d6f1f363ce5192b427215b44618e1be9e2a34018e5507d7cfb
SHA512c53e2ac301dae570544db66f613c141e058e3bee07cd2e1cffe958d3a76fff9bc040266d4a0064d9badae860f0543d72d904ea37f9215c2b5940f4fff27bf3d0
-
memory/808-72-0x0000000000000000-mapping.dmp
-
memory/832-73-0x0000000005330000-0x00000000054A2000-memory.dmpFilesize
1.4MB
-
memory/832-66-0x0000000006490000-0x0000000006830000-memory.dmpFilesize
3.6MB
-
memory/832-62-0x0000000000000000-mapping.dmp
-
memory/832-65-0x0000000000E40000-0x00000000015B4000-memory.dmpFilesize
7.5MB
-
memory/1168-94-0x0000000000000000-mapping.dmp
-
memory/1184-97-0x0000000000000000-mapping.dmp
-
memory/1188-96-0x0000000000000000-mapping.dmp
-
memory/1348-70-0x000000006FB70000-0x000000007011B000-memory.dmpFilesize
5.7MB
-
memory/1348-71-0x000000006FB70000-0x000000007011B000-memory.dmpFilesize
5.7MB
-
memory/1348-69-0x000000006FB70000-0x000000007011B000-memory.dmpFilesize
5.7MB
-
memory/1348-67-0x0000000000000000-mapping.dmp
-
memory/1496-93-0x000000006F8D0000-0x000000006FE7B000-memory.dmpFilesize
5.7MB
-
memory/1496-78-0x0000000000000000-mapping.dmp
-
memory/1628-54-0x0000000000000000-mapping.dmp
-
memory/1628-56-0x0000000075BE1000-0x0000000075BE3000-memory.dmpFilesize
8KB
-
memory/1960-82-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1960-89-0x0000000000464C20-mapping.dmp
-
memory/1960-86-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1960-92-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1960-88-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1960-83-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1960-77-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1960-95-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1960-80-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1960-75-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1960-74-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB