Analysis
-
max time kernel
118s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-02-2023 13:20
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20221111-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1700-66-0x0000000006510000-0x00000000068B0000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Executes dropped EXE 2 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exepid process 884 voiceadequovl.exe 1700 voiceadequovl.exe -
Loads dropped DLL 4 IoCs
Processes:
voiceadequovl.exepid process 884 voiceadequovl.exe 884 voiceadequovl.exe 884 voiceadequovl.exe 884 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2040 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
voiceadequovl.exepowershell.exedescription pid process Token: SeDebugPrivilege 1700 voiceadequovl.exe Token: SeDebugPrivilege 2040 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.exedescription pid process target process PID 1080 wrote to memory of 884 1080 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1080 wrote to memory of 884 1080 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1080 wrote to memory of 884 1080 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1080 wrote to memory of 884 1080 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 884 wrote to memory of 1700 884 voiceadequovl.exe voiceadequovl.exe PID 884 wrote to memory of 1700 884 voiceadequovl.exe voiceadequovl.exe PID 884 wrote to memory of 1700 884 voiceadequovl.exe voiceadequovl.exe PID 884 wrote to memory of 1700 884 voiceadequovl.exe voiceadequovl.exe PID 1700 wrote to memory of 2040 1700 voiceadequovl.exe powershell.exe PID 1700 wrote to memory of 2040 1700 voiceadequovl.exe powershell.exe PID 1700 wrote to memory of 2040 1700 voiceadequovl.exe powershell.exe PID 1700 wrote to memory of 2040 1700 voiceadequovl.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
226.5MB
MD50099e0be0126d2994d15a0381712357b
SHA1524be4c943d59133305f56546c0b1eff3a1048f2
SHA256c3e42879fcaf298497592aea07de339e30a6fdeaa62a4d0f71edbc368f38c1b6
SHA5124c591527048e2924efd5a15dd88350085cf47a1b1cc7d85772ebab3f70e54394210a3be97663d6773520bf99bd19501e0ad5edf477ef964e201a9b16149adfd7
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
226.3MB
MD58594f5b69c6e88150a86beaa456e74a6
SHA14f2ca01c37381494f547b7e8f915bab450e4b61d
SHA256088a474e61cb61dea884589e8b161c87102b4f531d89ecd16a7ddbd9dd1dbf5e
SHA512093402b503790998de21b5ecaf77085e3c974ff4ef1db65870c108c8f9df3a71c671b99fd40e13b554ae115e03c7e343abc51a167f42f6caa0066f23cde46fff
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
253.9MB
MD5b193bd6f1fc077a192bdd9537a5c426d
SHA15026f88d719200e5a46f93b0aab53d84d939b16d
SHA256d620ece026a5b89b1a8ffe2d511695d88d6d43a9e907a0ebc86d1e28c4d359e0
SHA5121fe147aead35a41e8cef4b5b2ac4785934c36d1b01f7d91d21ba6258641bfafdae990a79325dc880d5a17669f7c15f71e91a2e383706b9908199c83761673fd3
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
207.3MB
MD5156d7736d84951c831c55868d161b8a1
SHA163ab65b5351942ca1460723947338b66fee2fd3f
SHA256c1caf638dc56db139efc413bfa858f21c3893584e1b19d27141ad9092c803ab9
SHA512696c6626d93f3077263cfdbe1e0c170e88e52762c42428404ae15dc88e21efa0c38f0d7bbe1c37e744f0081a601fe0d7be68eb330d807d12da8db345a3e3b85c
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
252.9MB
MD5a58e7414480d0ba2faee62e8e765db12
SHA12f605d8279d76c0ad744ee50e06b0c0ddddd21a9
SHA2568c0aeae7d4f9ac3796aaafad78918fc916e6d700d48bf828cf84241aa3c458e8
SHA512dc3ce0b1a2136f119076805f802272f45367cceffebb2c94a5935adc69c9618af81d822d92459f320619bdaf80bcb8188e8198748c1ef6104889bb523edebe05
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
253.2MB
MD56c0fd2ed5c59b4a11d0367ae09208051
SHA1778879ed722cb56ff82236c9c8041f3aaa9d99ab
SHA256f31001c939e65e5756240932922a867630f1596d65fe1d65e0af46d95c8b0ab9
SHA51269f860aaa2b32bac59e4377272f826acd21a1bd83b261a3ae32e609451d2f8790b27ae0c1d7587396aecdbb5af8f394e22ddef5aa8c81669765894f7f8e8f17a
-
memory/884-56-0x0000000076411000-0x0000000076413000-memory.dmpFilesize
8KB
-
memory/884-54-0x0000000000000000-mapping.dmp
-
memory/1700-62-0x0000000000000000-mapping.dmp
-
memory/1700-65-0x00000000000B0000-0x0000000000824000-memory.dmpFilesize
7.5MB
-
memory/1700-66-0x0000000006510000-0x00000000068B0000-memory.dmpFilesize
3.6MB
-
memory/2040-67-0x0000000000000000-mapping.dmp
-
memory/2040-69-0x000000006FC70000-0x000000007021B000-memory.dmpFilesize
5.7MB
-
memory/2040-70-0x000000006FC70000-0x000000007021B000-memory.dmpFilesize
5.7MB