Analysis
-
max time kernel
97s -
max time network
102s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-02-2023 13:23
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20220812-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1752-66-0x0000000006460000-0x0000000006800000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Executes dropped EXE 3 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exevoiceadequovl.exepid process 2028 voiceadequovl.exe 1752 voiceadequovl.exe 1616 voiceadequovl.exe -
Loads dropped DLL 4 IoCs
Processes:
voiceadequovl.exepid process 2028 voiceadequovl.exe 2028 voiceadequovl.exe 2028 voiceadequovl.exe 2028 voiceadequovl.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
voiceadequovl.exedescription pid process target process PID 1752 set thread context of 1616 1752 voiceadequovl.exe voiceadequovl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 1056 powershell.exe 1548 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
voiceadequovl.exepowershell.exepowershell.exewmic.exeWMIC.exedescription pid process Token: SeDebugPrivilege 1752 voiceadequovl.exe Token: SeDebugPrivilege 1056 powershell.exe Token: SeDebugPrivilege 1548 powershell.exe Token: SeIncreaseQuotaPrivilege 1824 wmic.exe Token: SeSecurityPrivilege 1824 wmic.exe Token: SeTakeOwnershipPrivilege 1824 wmic.exe Token: SeLoadDriverPrivilege 1824 wmic.exe Token: SeSystemProfilePrivilege 1824 wmic.exe Token: SeSystemtimePrivilege 1824 wmic.exe Token: SeProfSingleProcessPrivilege 1824 wmic.exe Token: SeIncBasePriorityPrivilege 1824 wmic.exe Token: SeCreatePagefilePrivilege 1824 wmic.exe Token: SeBackupPrivilege 1824 wmic.exe Token: SeRestorePrivilege 1824 wmic.exe Token: SeShutdownPrivilege 1824 wmic.exe Token: SeDebugPrivilege 1824 wmic.exe Token: SeSystemEnvironmentPrivilege 1824 wmic.exe Token: SeRemoteShutdownPrivilege 1824 wmic.exe Token: SeUndockPrivilege 1824 wmic.exe Token: SeManageVolumePrivilege 1824 wmic.exe Token: 33 1824 wmic.exe Token: 34 1824 wmic.exe Token: 35 1824 wmic.exe Token: SeIncreaseQuotaPrivilege 1824 wmic.exe Token: SeSecurityPrivilege 1824 wmic.exe Token: SeTakeOwnershipPrivilege 1824 wmic.exe Token: SeLoadDriverPrivilege 1824 wmic.exe Token: SeSystemProfilePrivilege 1824 wmic.exe Token: SeSystemtimePrivilege 1824 wmic.exe Token: SeProfSingleProcessPrivilege 1824 wmic.exe Token: SeIncBasePriorityPrivilege 1824 wmic.exe Token: SeCreatePagefilePrivilege 1824 wmic.exe Token: SeBackupPrivilege 1824 wmic.exe Token: SeRestorePrivilege 1824 wmic.exe Token: SeShutdownPrivilege 1824 wmic.exe Token: SeDebugPrivilege 1824 wmic.exe Token: SeSystemEnvironmentPrivilege 1824 wmic.exe Token: SeRemoteShutdownPrivilege 1824 wmic.exe Token: SeUndockPrivilege 1824 wmic.exe Token: SeManageVolumePrivilege 1824 wmic.exe Token: 33 1824 wmic.exe Token: 34 1824 wmic.exe Token: 35 1824 wmic.exe Token: SeIncreaseQuotaPrivilege 1712 WMIC.exe Token: SeSecurityPrivilege 1712 WMIC.exe Token: SeTakeOwnershipPrivilege 1712 WMIC.exe Token: SeLoadDriverPrivilege 1712 WMIC.exe Token: SeSystemProfilePrivilege 1712 WMIC.exe Token: SeSystemtimePrivilege 1712 WMIC.exe Token: SeProfSingleProcessPrivilege 1712 WMIC.exe Token: SeIncBasePriorityPrivilege 1712 WMIC.exe Token: SeCreatePagefilePrivilege 1712 WMIC.exe Token: SeBackupPrivilege 1712 WMIC.exe Token: SeRestorePrivilege 1712 WMIC.exe Token: SeShutdownPrivilege 1712 WMIC.exe Token: SeDebugPrivilege 1712 WMIC.exe Token: SeSystemEnvironmentPrivilege 1712 WMIC.exe Token: SeRemoteShutdownPrivilege 1712 WMIC.exe Token: SeUndockPrivilege 1712 WMIC.exe Token: SeManageVolumePrivilege 1712 WMIC.exe Token: 33 1712 WMIC.exe Token: 34 1712 WMIC.exe Token: 35 1712 WMIC.exe Token: SeIncreaseQuotaPrivilege 1712 WMIC.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exevoiceadequovl.execmd.execmd.exedescription pid process target process PID 980 wrote to memory of 2028 980 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 980 wrote to memory of 2028 980 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 980 wrote to memory of 2028 980 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 980 wrote to memory of 2028 980 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 2028 wrote to memory of 1752 2028 voiceadequovl.exe voiceadequovl.exe PID 2028 wrote to memory of 1752 2028 voiceadequovl.exe voiceadequovl.exe PID 2028 wrote to memory of 1752 2028 voiceadequovl.exe voiceadequovl.exe PID 2028 wrote to memory of 1752 2028 voiceadequovl.exe voiceadequovl.exe PID 1752 wrote to memory of 1056 1752 voiceadequovl.exe powershell.exe PID 1752 wrote to memory of 1056 1752 voiceadequovl.exe powershell.exe PID 1752 wrote to memory of 1056 1752 voiceadequovl.exe powershell.exe PID 1752 wrote to memory of 1056 1752 voiceadequovl.exe powershell.exe PID 1752 wrote to memory of 880 1752 voiceadequovl.exe cmd.exe PID 1752 wrote to memory of 880 1752 voiceadequovl.exe cmd.exe PID 1752 wrote to memory of 880 1752 voiceadequovl.exe cmd.exe PID 1752 wrote to memory of 880 1752 voiceadequovl.exe cmd.exe PID 880 wrote to memory of 1548 880 cmd.exe powershell.exe PID 880 wrote to memory of 1548 880 cmd.exe powershell.exe PID 880 wrote to memory of 1548 880 cmd.exe powershell.exe PID 880 wrote to memory of 1548 880 cmd.exe powershell.exe PID 1752 wrote to memory of 1616 1752 voiceadequovl.exe voiceadequovl.exe PID 1752 wrote to memory of 1616 1752 voiceadequovl.exe voiceadequovl.exe PID 1752 wrote to memory of 1616 1752 voiceadequovl.exe voiceadequovl.exe PID 1752 wrote to memory of 1616 1752 voiceadequovl.exe voiceadequovl.exe PID 1752 wrote to memory of 1616 1752 voiceadequovl.exe voiceadequovl.exe PID 1752 wrote to memory of 1616 1752 voiceadequovl.exe voiceadequovl.exe PID 1752 wrote to memory of 1616 1752 voiceadequovl.exe voiceadequovl.exe PID 1752 wrote to memory of 1616 1752 voiceadequovl.exe voiceadequovl.exe PID 1752 wrote to memory of 1616 1752 voiceadequovl.exe voiceadequovl.exe PID 1752 wrote to memory of 1616 1752 voiceadequovl.exe voiceadequovl.exe PID 1752 wrote to memory of 1616 1752 voiceadequovl.exe voiceadequovl.exe PID 1752 wrote to memory of 1616 1752 voiceadequovl.exe voiceadequovl.exe PID 1616 wrote to memory of 1824 1616 voiceadequovl.exe wmic.exe PID 1616 wrote to memory of 1824 1616 voiceadequovl.exe wmic.exe PID 1616 wrote to memory of 1824 1616 voiceadequovl.exe wmic.exe PID 1616 wrote to memory of 1824 1616 voiceadequovl.exe wmic.exe PID 1616 wrote to memory of 1964 1616 voiceadequovl.exe cmd.exe PID 1616 wrote to memory of 1964 1616 voiceadequovl.exe cmd.exe PID 1616 wrote to memory of 1964 1616 voiceadequovl.exe cmd.exe PID 1616 wrote to memory of 1964 1616 voiceadequovl.exe cmd.exe PID 1964 wrote to memory of 1712 1964 cmd.exe WMIC.exe PID 1964 wrote to memory of 1712 1964 cmd.exe WMIC.exe PID 1964 wrote to memory of 1712 1964 cmd.exe WMIC.exe PID 1964 wrote to memory of 1712 1964 cmd.exe WMIC.exe PID 1616 wrote to memory of 2004 1616 voiceadequovl.exe cmd.exe PID 1616 wrote to memory of 2004 1616 voiceadequovl.exe cmd.exe PID 1616 wrote to memory of 2004 1616 voiceadequovl.exe cmd.exe PID 1616 wrote to memory of 2004 1616 voiceadequovl.exe cmd.exe PID 2004 wrote to memory of 1364 2004 cmd.exe WMIC.exe PID 2004 wrote to memory of 1364 2004 cmd.exe WMIC.exe PID 2004 wrote to memory of 1364 2004 cmd.exe WMIC.exe PID 2004 wrote to memory of 1364 2004 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5cc1f3ca48a90a45d09ca6d64da3ee160
SHA1bf2eb1a830bd830ae4a83ed3df2662342c4faf90
SHA256d39797cd724022506123c334525a29cda727deb5e512be2815834aa4e3ae2509
SHA51214ea7c60259ebeeea0b5670edf15f7de1c6415feeb0bce6ab86775b0d15d9b35c67206c69b7eae63d8f7442faa47d37a666caf60ceebb1b28d6eb3235ac344d4
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
354.0MB
MD50589744e604dab45cffdf069f9dddfde
SHA16accbe590a5ed0bf2533df97e454660d1d5bc6ab
SHA2569f4189ebb408e1b8000c1708176c5af80bbc2cd958d5e6b66968390973f5903a
SHA512d6bb588ca4fc07ffa8fb8a7bb975958c3484e2a86b2f999243674e66dd94cc89281c60eca1918aa42a6f9f32508c483aad16af6112054c44c288c0d470dbad40
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
360.0MB
MD5af5700b9d67adf5b23c173a43e047eaa
SHA1bda403b54a84b931603d2f4acd45fb0f307badf7
SHA256efedadf5dddacb6eb4e4d31100213f9fea3a6ca959c4854778381235dafb359a
SHA512f187b3bfbdcbe77a54d3b80f7141f0fbacfb35d06eb8d0e3bc39695ded83e02d220f67685e4c06d572fa617e8d92247ee45aad38cfffd16050a8ebe5e9402bea
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
191.4MB
MD5e0cbbf3cef6a47c4c4d004eb986a4589
SHA17a220e8a2c2e0261e97178fc25c2b8bf97bda574
SHA2569916db0ceac052be2a84763eae443e4d67cff4d138c51e9dcfaae69e92a2304c
SHA512e7a56b15029f4735522c095648d084aa9fe2ece783b1043f1003946f705f67077c6a58e55d518cd5b4488e8491d63be1b0661000802511f7fa16f02608b4af29
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
356.9MB
MD559b596bf09f3ae0a0a79834d4cc5277b
SHA1d21bd330e29bff58e29515b36d88728e8e855eb4
SHA25654b216b3d8e336b04664f77db9faf5b62d5e15b49b94583b4e971f4e220b2f11
SHA5124c1fc8606f4074f84b4d3161aab76ee481ab363d07523489699a8d8333ba16ae3a26d0680c7430a12f4febfe0143b36f7be8f0638109354fdb693b654bf1bd56
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
355.8MB
MD5c08c12cc0ea770f1242723ed94f8de1e
SHA1678e1b6cf8b521c3fcd6fb3ac59d562299bb9d63
SHA2566512e71dd3ebe2a92a6578ff90c126b27872fbc23313f7ee8c8b21624f646720
SHA5121f43a9118249833766ff697023795010acb5e406f0a11a0b8a20c8144c706092d8b155c37a52d5285e6d411345531d29045724b9b1eedd9441472ea5e5ebd222
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
349.4MB
MD5019e6ce55e3522204e1c3ab4dc65add8
SHA14f366e1341df8f2e2e1083c848c7cc9a6ec06920
SHA25603d99fa1dc2fe81d09ef92450e0fcbb55aef86f7bba0b34b95eee7c314275e17
SHA512fccaafc225781e88567d42f99bd40acd1dc6a911fcbb3bbf9ea2fee70c6d7f96c540a419d34d31c43c4e2d61aa7a4fb13afac11bdfdc89eb67c011aa87106a0d
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
358.2MB
MD5615a0b521ef5882a3089da98f8420dea
SHA19bf4dee8f990674cfcf2bc693113ba47ddf4f66a
SHA256b80d81e9b1e41e0257b357ff475b26e3b3eb642954112e43631b941d5e1be896
SHA512bc52f3edd5b070b20c5d68c202d58dff0a877ff5d7f82fc8bf37b21d4aa2c6281eb6dfed2995b560bcbeb0b8c54b6400d2108b3534b9502235f085ba05549cd8
-
memory/880-72-0x0000000000000000-mapping.dmp
-
memory/1056-70-0x000000006F750000-0x000000006FCFB000-memory.dmpFilesize
5.7MB
-
memory/1056-71-0x000000006F750000-0x000000006FCFB000-memory.dmpFilesize
5.7MB
-
memory/1056-67-0x0000000000000000-mapping.dmp
-
memory/1056-69-0x000000006F750000-0x000000006FCFB000-memory.dmpFilesize
5.7MB
-
memory/1364-100-0x0000000000000000-mapping.dmp
-
memory/1548-74-0x0000000000000000-mapping.dmp
-
memory/1548-95-0x000000006F1A0000-0x000000006F74B000-memory.dmpFilesize
5.7MB
-
memory/1548-83-0x000000006F1A0000-0x000000006F74B000-memory.dmpFilesize
5.7MB
-
memory/1616-88-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1616-80-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1616-78-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1616-101-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1616-76-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1616-94-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1616-82-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1616-85-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1616-86-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1616-93-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1616-89-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1616-90-0x0000000000464C20-mapping.dmp
-
memory/1712-98-0x0000000000000000-mapping.dmp
-
memory/1752-66-0x0000000006460000-0x0000000006800000-memory.dmpFilesize
3.6MB
-
memory/1752-73-0x0000000005330000-0x00000000054A2000-memory.dmpFilesize
1.4MB
-
memory/1752-65-0x0000000001200000-0x0000000001974000-memory.dmpFilesize
7.5MB
-
memory/1752-62-0x0000000000000000-mapping.dmp
-
memory/1824-96-0x0000000000000000-mapping.dmp
-
memory/1964-97-0x0000000000000000-mapping.dmp
-
memory/2004-99-0x0000000000000000-mapping.dmp
-
memory/2028-56-0x0000000075811000-0x0000000075813000-memory.dmpFilesize
8KB
-
memory/2028-54-0x0000000000000000-mapping.dmp