Analysis
-
max time kernel
83s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05-02-2023 16:04
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20221111-en
General
-
Target
tmp.exe
-
Size
3.0MB
-
MD5
cdb75538c7adc7829a93cdf9a27c1fd7
-
SHA1
2e5ff4e8f2b4b087ccc7f4cb2ad59d4c3617a0c9
-
SHA256
dd218eb78e26587e43df5f00ff3ad87e23154c672615309a193a657323b62e20
-
SHA512
f6eab79f9ba0111608ddc3b81b57224e5ccc86f2a4b3f14a11ef627a2d44f6539c061d5bcad7a68f7df0c05bbcb14d0285bfa508085233075452a3a75d1671d4
-
SSDEEP
98304:k5Sh7zrcGtirr9gIKvvwPDxISVNImdJ3R9/4:WAXrjtirrGIyYTD3R9A
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/940-55-0x00000000201B0000-0x0000000020496000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exetmp.exepid process 580 powershell.exe 940 tmp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tmp.exepowershell.exedescription pid process Token: SeDebugPrivilege 940 tmp.exe Token: SeDebugPrivilege 580 powershell.exe Token: SeDebugPrivilege 940 tmp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
tmp.exedescription pid process target process PID 940 wrote to memory of 580 940 tmp.exe powershell.exe PID 940 wrote to memory of 580 940 tmp.exe powershell.exe PID 940 wrote to memory of 580 940 tmp.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANgA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/580-64-0x000000000282B000-0x000000000284A000-memory.dmpFilesize
124KB
-
memory/580-61-0x0000000002824000-0x0000000002827000-memory.dmpFilesize
12KB
-
memory/580-56-0x0000000000000000-mapping.dmp
-
memory/580-57-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmpFilesize
8KB
-
memory/580-62-0x000000000282B000-0x000000000284A000-memory.dmpFilesize
124KB
-
memory/580-59-0x000007FEED340000-0x000007FEEDD63000-memory.dmpFilesize
10.1MB
-
memory/580-60-0x000007FEEC7E0000-0x000007FEED33D000-memory.dmpFilesize
11.4MB
-
memory/580-63-0x0000000002824000-0x0000000002827000-memory.dmpFilesize
12KB
-
memory/940-71-0x000000001C650000-0x000000001C69C000-memory.dmpFilesize
304KB
-
memory/940-55-0x00000000201B0000-0x0000000020496000-memory.dmpFilesize
2.9MB
-
memory/940-73-0x0000000002547000-0x0000000002566000-memory.dmpFilesize
124KB
-
memory/940-65-0x000000001BF00000-0x000000001BFD6000-memory.dmpFilesize
856KB
-
memory/940-66-0x000000001C090000-0x000000001C12B000-memory.dmpFilesize
620KB
-
memory/940-67-0x000000001C6F0000-0x000000001C788000-memory.dmpFilesize
608KB
-
memory/940-68-0x000000001D900000-0x000000001D9B4000-memory.dmpFilesize
720KB
-
memory/940-69-0x000000001BDF0000-0x000000001BE46000-memory.dmpFilesize
344KB
-
memory/940-70-0x000000001C1D0000-0x000000001C224000-memory.dmpFilesize
336KB
-
memory/940-54-0x000000013FD50000-0x0000000140056000-memory.dmpFilesize
3.0MB
-
memory/940-72-0x000000001C840000-0x000000001C894000-memory.dmpFilesize
336KB
-
memory/940-58-0x0000000002547000-0x0000000002566000-memory.dmpFilesize
124KB