Analysis
-
max time kernel
137s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-02-2023 13:29
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20221111-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1520-66-0x0000000006450000-0x00000000067F0000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Executes dropped EXE 2 IoCs
Processes:
voiceadequovl.exevoiceadequovl.exepid process 976 voiceadequovl.exe 1520 voiceadequovl.exe -
Loads dropped DLL 4 IoCs
Processes:
voiceadequovl.exepid process 976 voiceadequovl.exe 976 voiceadequovl.exe 976 voiceadequovl.exe 976 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1740 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
voiceadequovl.exepowershell.exedescription pid process Token: SeDebugPrivilege 1520 voiceadequovl.exe Token: SeDebugPrivilege 1740 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.exedescription pid process target process PID 1916 wrote to memory of 976 1916 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1916 wrote to memory of 976 1916 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1916 wrote to memory of 976 1916 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 1916 wrote to memory of 976 1916 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe voiceadequovl.exe PID 976 wrote to memory of 1520 976 voiceadequovl.exe voiceadequovl.exe PID 976 wrote to memory of 1520 976 voiceadequovl.exe voiceadequovl.exe PID 976 wrote to memory of 1520 976 voiceadequovl.exe voiceadequovl.exe PID 976 wrote to memory of 1520 976 voiceadequovl.exe voiceadequovl.exe PID 1520 wrote to memory of 1740 1520 voiceadequovl.exe powershell.exe PID 1520 wrote to memory of 1740 1520 voiceadequovl.exe powershell.exe PID 1520 wrote to memory of 1740 1520 voiceadequovl.exe powershell.exe PID 1520 wrote to memory of 1740 1520 voiceadequovl.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeFilesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
247.5MB
MD524e56541f863b3425ee342fdeb1fa9d6
SHA10b6cda9b618ac4f9c9c59ac50849552d9a55d2be
SHA256649683fce740a3a8b61ecb227d22da051d1b014710e6c932c5b4d7f056c84e1f
SHA512aa327fd41a26e68c993afcb2e665ec498b36542beb6924495edc84051b60132253ab15b37de0ee66f8476bf3af6017b9fb72cae434dc94eb90402bf1c8c61ffc
-
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
237.1MB
MD569acf52b98e54723f8e9654456f26a76
SHA1b90ec07466ad17fd3e5aae0cbf10416b2c40f522
SHA256e10643095e20dbba531f2ddb1f9f7d811ef320023eb360346f36b7f57df44944
SHA512e9e417949d53a699a69f448f72bb3b346bb73516ae9708c5e20653680ac36cd0ed3ba06402e551a1c79e794f9913720b133177c4ba2f38b1b47a04dfde7533b0
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
242.4MB
MD570ca98f6b6e2f19d58fd88341aaf4373
SHA158d77cb1b50f819cd1b20d742f83481638cc1cd6
SHA256085fed4f510b09d3f804dc663024ac190bde5c0c2db1922c8223435e4ee5d84d
SHA512754f558e1cc2273aaa011b530d67cbac682d6b5a94c14e4c6b2ba978730e6155a975b6f1eff6420d7f45b220ab66a5e2a65994de84dca8afe140aee4535c61b2
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
228.8MB
MD525ec587592d75b44f6d7106b7b206788
SHA1c55e27e0700ba61e31495d60b692975549d6fca7
SHA256fd7a0a53d63a3e3a2af1c4c44d01df27d9a775db51e005af2f95abc9333e8cde
SHA5121c36f1aa3f33ec4d7949a882a3724d630d2ab3ae5e00988676951cfd92b800e63e6371706c002628856983704629805107ec1f4c50e276616a83c2e27c082480
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
238.7MB
MD5ab62da9cf1f6aac48c79866376f134a4
SHA14d944d80cb465ac2dfef5045d7651b1e286ec352
SHA256a9441308bfbfccd79b1240b4f44a09ea132fed07c2d8caeee56f4b3a1a66d682
SHA5120a330772aebdc75ffb90cc8d3c18e486c940764671cb3393e98e76d412c7421f9c15806ac5d6a664ef7e3ebfb4d7fcc76380009c68e667a0423caa144964673c
-
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exeFilesize
207.6MB
MD5819e52f78d32ed5456091b1476c8c9bc
SHA1fcb172d81b2bf3bca6b35a67a214b420d015ccb9
SHA256750b1fdc3460234f43055f9990fac114e431e1f5d96a17556e8adbc29501527a
SHA5128e6b2349043a52b481701ef5c24ff8afdd96db9a908cde4ee19fbfa71c461dd9cc807234687f12ddb5cc991b88412a4c33e7a1efd671c91eca1f933526f931f3
-
memory/976-56-0x0000000075A81000-0x0000000075A83000-memory.dmpFilesize
8KB
-
memory/976-54-0x0000000000000000-mapping.dmp
-
memory/1520-62-0x0000000000000000-mapping.dmp
-
memory/1520-65-0x0000000000BF0000-0x0000000001364000-memory.dmpFilesize
7.5MB
-
memory/1520-66-0x0000000006450000-0x00000000067F0000-memory.dmpFilesize
3.6MB
-
memory/1740-67-0x0000000000000000-mapping.dmp
-
memory/1740-69-0x000000006F570000-0x000000006FB1B000-memory.dmpFilesize
5.7MB
-
memory/1740-70-0x000000006F570000-0x000000006FB1B000-memory.dmpFilesize
5.7MB