Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05-02-2023 13:19
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20221111-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1920-66-0x0000000006380000-0x0000000006720000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Executes dropped EXE 2 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exepid process 1348 voiceadequovl.exe 1920 voiceadequovl.exe -
Loads dropped DLL 4 IoCs
Processes:
voiceadequovl.exepid process 1348 voiceadequovl.exe 1348 voiceadequovl.exe 1348 voiceadequovl.exe 1348 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 812 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
voiceadequovl.exepowershell.exedescription pid process Token: SeDebugPrivilege 1920 voiceadequovl.exe Token: SeDebugPrivilege 812 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.exedescription pid process target process PID 1808 wrote to memory of 1348 1808 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1808 wrote to memory of 1348 1808 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1808 wrote to memory of 1348 1808 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1808 wrote to memory of 1348 1808 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1348 wrote to memory of 1920 1348 voiceadequovl.exe voiceadequovl.exe PID 1348 wrote to memory of 1920 1348 voiceadequovl.exe voiceadequovl.exe PID 1348 wrote to memory of 1920 1348 voiceadequovl.exe voiceadequovl.exe PID 1348 wrote to memory of 1920 1348 voiceadequovl.exe voiceadequovl.exe PID 1920 wrote to memory of 812 1920 voiceadequovl.exe powershell.exe PID 1920 wrote to memory of 812 1920 voiceadequovl.exe powershell.exe PID 1920 wrote to memory of 812 1920 voiceadequovl.exe powershell.exe PID 1920 wrote to memory of 812 1920 voiceadequovl.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
247.8MB
MD5f580ae4f52d50675a416c06ddc76e7e2
SHA1fcbf8abffc071fef56604a3f7b056dc1504cc8ac
SHA256b0fe4dc11d8daec1638b70150526930d8c6f9f37bd667e1570d748360ae5ab84
SHA5122faa37de4d966b74b56a88e3d4b93725874123c3c112f5ed0527c1f260e2e93dd483f58553d53432fefe7082136ae2244aa3be9429ca3e4d1a42beb9f4c2fb9a
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
270.4MB
MD5bf3db2e9927582ffef71c73971c1e1f5
SHA15a363066472077fcc5cbcf44a8f59f7f5d658718
SHA256b3b1644f8b88bb46b52ff24e981b6e147b4d1e44b93ee59487c3e8479ebe4337
SHA512a5648d89216ea1d7d5b52d1b2da32043a21c2f3d1f77f3c380fc8618c6421f7bb1c63474981439901f4c744d7dbd9c380fbe51e88573b38eb150c1ffd3716fb0
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
266.4MB
MD53126aeea44fc047cda1a8692682ffbe9
SHA1f3b99953b063e98d1c9e87dc40dbce26e366f546
SHA256432ec4678a667f5e381ad7b24bee3a0794327455c307a271b4d8d59a72539126
SHA512061098b8911d14589ab945cf6f99f3b31e30cf07061518de93766c15401a400eecb752f716b17957d3a7b61976bafbfb54dcd94f100d4696ed42277f220b9471
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
262.0MB
MD5d9b638d8871fdd7212f34b2c281f4394
SHA1572cb1bf459e57618cabdcef0545bb864e68dca9
SHA2560da5cc14c8250268a0060f217ce9c7ffa314695d6d84e26cc8b2cf2156026c88
SHA5125b01a7c74c4866f0b72383499bc3cdad4fad22f6f2840ace5cbea2c62c8d32a68ee231fcabbb08c58e00c6aec037f46d92aa28c67ca908b6150d42188008fa80
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
256.4MB
MD56175cf92c8b53e7178a0e756e5395926
SHA13f5156c37613bb3b56bb98bd6f26c5867cf2d138
SHA2561268d6a4e92805fbbc38151295ff9542654fd077ccc0e01165f3b3417af155d4
SHA5124edcdc27ca3daeb41d6d6aadca05a6c3ec401722457f223024edc923aab206a3d9aef3041b62bce4882170caa0a9a4a7b6108dc611709b4c89411000648282fc
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
284.6MB
MD520d6a2d41b5fdf8ef904f3593fa0a7c8
SHA1d89b7d11f5e2bc10602e81becdedaf0f8e3079bd
SHA256061935701ec0ecda4c437e6a441309afe3c3bb746eb776f550d5f873b2ca5eab
SHA5120df9db5a283530713c56ce938392131d128a03822172372a6ef2e47e060f3b4231810f7e3383772da3fbb409eb58d732ed1977394b200d6a4bdd5e2ad5137561
-
memory/812-70-0x00000000701F0000-0x000000007079B000-memory.dmpFilesize
5.7MB
-
memory/812-71-0x00000000701F0000-0x000000007079B000-memory.dmpFilesize
5.7MB
-
memory/812-67-0x0000000000000000-mapping.dmp
-
memory/812-69-0x00000000701F0000-0x000000007079B000-memory.dmpFilesize
5.7MB
-
memory/960-72-0x0000000000000000-mapping.dmp
-
memory/1348-56-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/1348-54-0x0000000000000000-mapping.dmp
-
memory/1920-62-0x0000000000000000-mapping.dmp
-
memory/1920-66-0x0000000006380000-0x0000000006720000-memory.dmpFilesize
3.6MB
-
memory/1920-65-0x0000000000CE0000-0x0000000001454000-memory.dmpFilesize
7.5MB
-
memory/1920-73-0x0000000005370000-0x00000000054E2000-memory.dmpFilesize
1.4MB