Analysis
-
max time kernel
79s -
max time network
86s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
05-02-2023 13:30
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20221111-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Extracted
aurora
45.9.74.11:8081
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/472-66-0x0000000006590000-0x0000000006930000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Executes dropped EXE 3 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exevoiceadequovl.exepid process 1080 voiceadequovl.exe 472 voiceadequovl.exe 948 voiceadequovl.exe -
Loads dropped DLL 4 IoCs
Processes:
voiceadequovl.exepid process 1080 voiceadequovl.exe 1080 voiceadequovl.exe 1080 voiceadequovl.exe 1080 voiceadequovl.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
voiceadequovl.exedescription pid process target process PID 472 set thread context of 948 472 voiceadequovl.exe voiceadequovl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 1768 powershell.exe 1812 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
voiceadequovl.exepowershell.exepowershell.exewmic.exeWMIC.exedescription pid process Token: SeDebugPrivilege 472 voiceadequovl.exe Token: SeDebugPrivilege 1768 powershell.exe Token: SeDebugPrivilege 1812 powershell.exe Token: SeIncreaseQuotaPrivilege 1092 wmic.exe Token: SeSecurityPrivilege 1092 wmic.exe Token: SeTakeOwnershipPrivilege 1092 wmic.exe Token: SeLoadDriverPrivilege 1092 wmic.exe Token: SeSystemProfilePrivilege 1092 wmic.exe Token: SeSystemtimePrivilege 1092 wmic.exe Token: SeProfSingleProcessPrivilege 1092 wmic.exe Token: SeIncBasePriorityPrivilege 1092 wmic.exe Token: SeCreatePagefilePrivilege 1092 wmic.exe Token: SeBackupPrivilege 1092 wmic.exe Token: SeRestorePrivilege 1092 wmic.exe Token: SeShutdownPrivilege 1092 wmic.exe Token: SeDebugPrivilege 1092 wmic.exe Token: SeSystemEnvironmentPrivilege 1092 wmic.exe Token: SeRemoteShutdownPrivilege 1092 wmic.exe Token: SeUndockPrivilege 1092 wmic.exe Token: SeManageVolumePrivilege 1092 wmic.exe Token: 33 1092 wmic.exe Token: 34 1092 wmic.exe Token: 35 1092 wmic.exe Token: SeIncreaseQuotaPrivilege 1092 wmic.exe Token: SeSecurityPrivilege 1092 wmic.exe Token: SeTakeOwnershipPrivilege 1092 wmic.exe Token: SeLoadDriverPrivilege 1092 wmic.exe Token: SeSystemProfilePrivilege 1092 wmic.exe Token: SeSystemtimePrivilege 1092 wmic.exe Token: SeProfSingleProcessPrivilege 1092 wmic.exe Token: SeIncBasePriorityPrivilege 1092 wmic.exe Token: SeCreatePagefilePrivilege 1092 wmic.exe Token: SeBackupPrivilege 1092 wmic.exe Token: SeRestorePrivilege 1092 wmic.exe Token: SeShutdownPrivilege 1092 wmic.exe Token: SeDebugPrivilege 1092 wmic.exe Token: SeSystemEnvironmentPrivilege 1092 wmic.exe Token: SeRemoteShutdownPrivilege 1092 wmic.exe Token: SeUndockPrivilege 1092 wmic.exe Token: SeManageVolumePrivilege 1092 wmic.exe Token: 33 1092 wmic.exe Token: 34 1092 wmic.exe Token: 35 1092 wmic.exe Token: SeIncreaseQuotaPrivilege 1936 WMIC.exe Token: SeSecurityPrivilege 1936 WMIC.exe Token: SeTakeOwnershipPrivilege 1936 WMIC.exe Token: SeLoadDriverPrivilege 1936 WMIC.exe Token: SeSystemProfilePrivilege 1936 WMIC.exe Token: SeSystemtimePrivilege 1936 WMIC.exe Token: SeProfSingleProcessPrivilege 1936 WMIC.exe Token: SeIncBasePriorityPrivilege 1936 WMIC.exe Token: SeCreatePagefilePrivilege 1936 WMIC.exe Token: SeBackupPrivilege 1936 WMIC.exe Token: SeRestorePrivilege 1936 WMIC.exe Token: SeShutdownPrivilege 1936 WMIC.exe Token: SeDebugPrivilege 1936 WMIC.exe Token: SeSystemEnvironmentPrivilege 1936 WMIC.exe Token: SeRemoteShutdownPrivilege 1936 WMIC.exe Token: SeUndockPrivilege 1936 WMIC.exe Token: SeManageVolumePrivilege 1936 WMIC.exe Token: 33 1936 WMIC.exe Token: 34 1936 WMIC.exe Token: 35 1936 WMIC.exe Token: SeIncreaseQuotaPrivilege 1936 WMIC.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exevoiceadequovl.execmd.execmd.exedescription pid process target process PID 1304 wrote to memory of 1080 1304 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1304 wrote to memory of 1080 1304 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1304 wrote to memory of 1080 1304 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1304 wrote to memory of 1080 1304 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1080 wrote to memory of 472 1080 voiceadequovl.exe voiceadequovl.exe PID 1080 wrote to memory of 472 1080 voiceadequovl.exe voiceadequovl.exe PID 1080 wrote to memory of 472 1080 voiceadequovl.exe voiceadequovl.exe PID 1080 wrote to memory of 472 1080 voiceadequovl.exe voiceadequovl.exe PID 472 wrote to memory of 1768 472 voiceadequovl.exe powershell.exe PID 472 wrote to memory of 1768 472 voiceadequovl.exe powershell.exe PID 472 wrote to memory of 1768 472 voiceadequovl.exe powershell.exe PID 472 wrote to memory of 1768 472 voiceadequovl.exe powershell.exe PID 472 wrote to memory of 928 472 voiceadequovl.exe cmd.exe PID 472 wrote to memory of 928 472 voiceadequovl.exe cmd.exe PID 472 wrote to memory of 928 472 voiceadequovl.exe cmd.exe PID 472 wrote to memory of 928 472 voiceadequovl.exe cmd.exe PID 928 wrote to memory of 1812 928 cmd.exe powershell.exe PID 928 wrote to memory of 1812 928 cmd.exe powershell.exe PID 928 wrote to memory of 1812 928 cmd.exe powershell.exe PID 928 wrote to memory of 1812 928 cmd.exe powershell.exe PID 472 wrote to memory of 948 472 voiceadequovl.exe voiceadequovl.exe PID 472 wrote to memory of 948 472 voiceadequovl.exe voiceadequovl.exe PID 472 wrote to memory of 948 472 voiceadequovl.exe voiceadequovl.exe PID 472 wrote to memory of 948 472 voiceadequovl.exe voiceadequovl.exe PID 472 wrote to memory of 948 472 voiceadequovl.exe voiceadequovl.exe PID 472 wrote to memory of 948 472 voiceadequovl.exe voiceadequovl.exe PID 472 wrote to memory of 948 472 voiceadequovl.exe voiceadequovl.exe PID 472 wrote to memory of 948 472 voiceadequovl.exe voiceadequovl.exe PID 472 wrote to memory of 948 472 voiceadequovl.exe voiceadequovl.exe PID 472 wrote to memory of 948 472 voiceadequovl.exe voiceadequovl.exe PID 472 wrote to memory of 948 472 voiceadequovl.exe voiceadequovl.exe PID 472 wrote to memory of 948 472 voiceadequovl.exe voiceadequovl.exe PID 948 wrote to memory of 1092 948 voiceadequovl.exe wmic.exe PID 948 wrote to memory of 1092 948 voiceadequovl.exe wmic.exe PID 948 wrote to memory of 1092 948 voiceadequovl.exe wmic.exe PID 948 wrote to memory of 1092 948 voiceadequovl.exe wmic.exe PID 948 wrote to memory of 1276 948 voiceadequovl.exe cmd.exe PID 948 wrote to memory of 1276 948 voiceadequovl.exe cmd.exe PID 948 wrote to memory of 1276 948 voiceadequovl.exe cmd.exe PID 948 wrote to memory of 1276 948 voiceadequovl.exe cmd.exe PID 1276 wrote to memory of 1936 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 1936 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 1936 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 1936 1276 cmd.exe WMIC.exe PID 948 wrote to memory of 1716 948 voiceadequovl.exe cmd.exe PID 948 wrote to memory of 1716 948 voiceadequovl.exe cmd.exe PID 948 wrote to memory of 1716 948 voiceadequovl.exe cmd.exe PID 948 wrote to memory of 1716 948 voiceadequovl.exe cmd.exe PID 1716 wrote to memory of 940 1716 cmd.exe WMIC.exe PID 1716 wrote to memory of 940 1716 cmd.exe WMIC.exe PID 1716 wrote to memory of 940 1716 cmd.exe WMIC.exe PID 1716 wrote to memory of 940 1716 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeC:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
184.2MB
MD51cfa8774c5287502f5023be6d506a88b
SHA19f089946a56d540f3b0c845e628a320fa6b4f6fa
SHA256b288b1b59a0ac2e125439c7ec11b9b284673ff7a7781e860fa673ebc7419dfaa
SHA512359ba138fcef707bb81bc95416349a32bba3ae771f85de7dbc85bb0fcfc51ddd356804f663873e0f5f6d4ae70cd4c000e41f1d3e4a6613f9816993d3b6bbcfe8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
169.4MB
MD58de895732b7bfdd81af86cdc1e0f91a6
SHA11af9df74d64d1abfd1d64db1c63c9f354a2e1a79
SHA256261467011ddde53aa7e16b7785426c26bfd6402078b36cdd6bde7b79845576b7
SHA512af6fdcc1544fa3b71fb5afa201cec490124be8e87bfacf7bfc6cedb127685b4a2aa2153f44358416a6e51fbca6cef65000424a281d416987f167301041e1350e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD520459ae558907e0472b25a4af2e7657e
SHA1370ffaf39a947aaf4795f69e42f8ea3918bbbdca
SHA25685547f33abc06ef9c03d56d59a2c9e57cc800efe89f5bdf17e7b237311594348
SHA512ef0e515dcfe4808cad55f8e67ccbdf2203bc00fe8dcdb5b0c5f9df8ecb102748f95c69805283c40aa6b6b8ed54fb7ef2e8be4514e798484b769b5f39ed113bc5
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
189.3MB
MD5141a84174a7e0223ab31af62c98d268d
SHA1cb1ca0af102524d10d47c7e5b6fcab43626f9ead
SHA25639b6d661c2929d9229603317fda273ab168477872869de71cb4b1e1c0129bb9a
SHA512ff0e1adb226218d88dc59f9bd93f753afd161371c4239c3d59b6a616c89d4078c5cfb76eb78405cb875148866468e7b9c70ae295dc69aa90325a8e538c374403
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
188.8MB
MD50c63819fd29de5e6a3e1dfad4605d39b
SHA1c4489d052064c51584b13bf71e3f8563a7c46121
SHA2563aed6e962fdab044c2091128b71976654287342e4c28a78771d91d4cef98bc82
SHA512fc783afa8120a28dd29a88ebac15883f3c40f081743e47484c036123cfda577b3a0ec7de038f12f53d38e65e9085ad675906d5b7e395e65eedb256f25d7a546f
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
126.8MB
MD559434b6993f2e954b0fa21918c2fa97a
SHA13d9f93c73cd596ccffd8f86f35b79371dd01097d
SHA256d487ae69a31acba42a392a435c72f52e8c2e76394255fd11cecb7bbccab35016
SHA51243ab3261b11e6e7ed87ab092a27987ba1e48cbc72b4bdca80fb9c3ad7c7bf14d0b0b0b143a49682b4d745a7a174c569326dcf4f901fb5bc43489e327f34f039a
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
187.7MB
MD57dd2a079ee0894010d36c77dc16e10c7
SHA1cbe7eadd5a863d6c6afbfbd8965f4230babfbcd6
SHA256c6ce4793b4ab819bf00bdabcafdcdddb14ce7188130f5a920e973d75198626d0
SHA512e86b899e2baf975fa71b4893f7f269e1a5111396ce5843db2c38bbb977148f15b25f31f518d845eb7a90d349c8565fb1ffa9e778e96d6583fab3e7f88b0dae8c
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
188.0MB
MD5a22e45f052004f0d0b8c3340406d51ab
SHA13736fd9d1d591c07e7aade488eed9acc2236b79e
SHA25697ff7ebf0ec3be2eb365b971a8f53f8fef59e86c435b3d1d37d8ae23086657ff
SHA512db46dcee0e86a30dfa18d372342a282bf4bf7d820fcff4966d8f687c54e004d7f218729304cfe49116d9e1e32b00bb6d0374d5a407b5ed912b65c1d57ba999b0
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
186.9MB
MD5657db771ba85fd54b31cf7a48ab12c1f
SHA1912f06cbec7fa11d789ce73a3a0bc46269c2b729
SHA256a70a957ff5a06b6be511af0358c0f49ca66d5bc5fb1eff317b89d100d8863d81
SHA512a2b04a3d347af2fa789c02b15a0fcfd893b70c01383dd66935c2c9209825b4ec661767c7d1257acec9391f093f9e8ea0eee5ff784cf7bcd67a7147e9f9ccf855
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
185.0MB
MD55008034af86783a85cc80700876f19c7
SHA1c7a492eb7be9ddd8342f249712982f8aa3b1853d
SHA256b7b076b88b5ea8b53a7776ab851d2e3954fc2dcb5fc7dbd165037d6711e76ec5
SHA5122e306cdf0725449f5144b4422528cb3e1546a7e09a7c5245ce3d8225ff8de65616e60a52f348e42a4fc399bb1c2f75ea72a46c57c84f023a4a2146312a6b7ff0
-
memory/472-62-0x0000000000000000-mapping.dmp
-
memory/472-65-0x0000000000820000-0x0000000000F94000-memory.dmpFilesize
7.5MB
-
memory/472-66-0x0000000006590000-0x0000000006930000-memory.dmpFilesize
3.6MB
-
memory/472-73-0x00000000054E0000-0x0000000005652000-memory.dmpFilesize
1.4MB
-
memory/928-72-0x0000000000000000-mapping.dmp
-
memory/940-100-0x0000000000000000-mapping.dmp
-
memory/948-76-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/948-89-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/948-102-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/948-101-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/948-94-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/948-78-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/948-93-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/948-80-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/948-82-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/948-84-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/948-85-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/948-90-0x0000000000464C20-mapping.dmp
-
memory/948-88-0x0000000000400000-0x0000000000731000-memory.dmpFilesize
3.2MB
-
memory/1080-54-0x0000000000000000-mapping.dmp
-
memory/1080-56-0x00000000762E1000-0x00000000762E3000-memory.dmpFilesize
8KB
-
memory/1092-96-0x0000000000000000-mapping.dmp
-
memory/1276-97-0x0000000000000000-mapping.dmp
-
memory/1716-99-0x0000000000000000-mapping.dmp
-
memory/1768-69-0x0000000070040000-0x00000000705EB000-memory.dmpFilesize
5.7MB
-
memory/1768-67-0x0000000000000000-mapping.dmp
-
memory/1768-71-0x0000000070040000-0x00000000705EB000-memory.dmpFilesize
5.7MB
-
memory/1768-70-0x0000000070040000-0x00000000705EB000-memory.dmpFilesize
5.7MB
-
memory/1812-95-0x000000006FDA0000-0x000000007034B000-memory.dmpFilesize
5.7MB
-
memory/1812-87-0x000000006FDA0000-0x000000007034B000-memory.dmpFilesize
5.7MB
-
memory/1812-74-0x0000000000000000-mapping.dmp
-
memory/1936-98-0x0000000000000000-mapping.dmp