purecrypter | 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6

General

Target

BLToolsMod.exe
Size

763KB
MD5

869037e716218fb7551d84b8ce7d0ae7
SHA1

12cb776519eeb2d5e6a7ab1ddce3a09f143d5f18
SHA256

305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6
SHA512

6840e10d1daeacd169dba4a0049bc3b9087726dd45551b9a9587d57ec45d926356ce1656a39fdf35c1acb4020c564ec1f6a910fd83cde99e3ff75195728c72d2
SSDEEP

12288:SAZdPU5ttcsREhy5IYU8OaNISOvsk0gnT467zpmw7OfimWm/YfdFxfJ:S2UVc+EhyuAOaNIBXnT46fpmiOfimWy4

Score

10^/10

purecrypter quasar revengerat office04 downloader loader persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office04

C2

youhackernetpaingodxd.duckdns.org:5557

blablashitspreading.ddns.net:5557

Mutex

xEoEv3HHdyEIYwJRFM

Attributes

encryption_key
w3WfcmWh1iXT9cxeKFEX
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Detect PureCrypter injector 1 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/928-66-0x0000000007430000-0x000000000769E000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1512-76-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/1512-77-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/1512-79-0x00000000004494BE-mapping.dmp	family_quasar
behavioral1/memory/1512-81-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/1512-78-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/1512-83-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

Updater-File.exe

pid process

928 Updater-File.exe
Loads dropped DLL 1 IoCs

Processes:

BLToolsMod.exe

pid process

532 BLToolsMod.exe

pid	process
928	Updater-File.exe

pid	process
532	BLToolsMod.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Updater-File.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Driver.exe\""	Updater-File.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

Updater-File.exe

description pid process target process

PID 928 set thread context of 1512 928 Updater-File.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

996 532 WerFault.exe BLToolsMod.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1072 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1912 powershell.exe

flow	ioc
8	ip-api.com

description	pid	process	target process
PID 928 set thread context of 1512	928	Updater-File.exe	RegAsm.exe

pid	pid_target	process	target process
996	532	WerFault.exe	BLToolsMod.exe

pid	process
1072	PING.EXE

pid	process
1912	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

BLToolsMod.exeUpdater-File.exepowershell.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	532	BLToolsMod.exe
Token: SeDebugPrivilege	928	Updater-File.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	1512	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegAsm.exe

pid process

1512 RegAsm.exe

pid	process
1512	RegAsm.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

BLToolsMod.exeUpdater-File.exeRegAsm.execmd.exe

description	pid	process	target process
PID 532 wrote to memory of 928	532	BLToolsMod.exe	Updater-File.exe
PID 532 wrote to memory of 928	532	BLToolsMod.exe	Updater-File.exe
PID 532 wrote to memory of 928	532	BLToolsMod.exe	Updater-File.exe
PID 532 wrote to memory of 928	532	BLToolsMod.exe	Updater-File.exe
PID 532 wrote to memory of 928	532	BLToolsMod.exe	Updater-File.exe
PID 532 wrote to memory of 928	532	BLToolsMod.exe	Updater-File.exe
PID 532 wrote to memory of 928	532	BLToolsMod.exe	Updater-File.exe
PID 532 wrote to memory of 996	532	BLToolsMod.exe	WerFault.exe
PID 532 wrote to memory of 996	532	BLToolsMod.exe	WerFault.exe
PID 532 wrote to memory of 996	532	BLToolsMod.exe	WerFault.exe
PID 532 wrote to memory of 996	532	BLToolsMod.exe	WerFault.exe
PID 928 wrote to memory of 1912	928	Updater-File.exe	powershell.exe
PID 928 wrote to memory of 1912	928	Updater-File.exe	powershell.exe
PID 928 wrote to memory of 1912	928	Updater-File.exe	powershell.exe
PID 928 wrote to memory of 1912	928	Updater-File.exe	powershell.exe
PID 928 wrote to memory of 1512	928	Updater-File.exe	RegAsm.exe
PID 928 wrote to memory of 1512	928	Updater-File.exe	RegAsm.exe
PID 928 wrote to memory of 1512	928	Updater-File.exe	RegAsm.exe
PID 928 wrote to memory of 1512	928	Updater-File.exe	RegAsm.exe
PID 928 wrote to memory of 1512	928	Updater-File.exe	RegAsm.exe
PID 928 wrote to memory of 1512	928	Updater-File.exe	RegAsm.exe
PID 928 wrote to memory of 1512	928	Updater-File.exe	RegAsm.exe
PID 928 wrote to memory of 1512	928	Updater-File.exe	RegAsm.exe
PID 928 wrote to memory of 1512	928	Updater-File.exe	RegAsm.exe
PID 928 wrote to memory of 1512	928	Updater-File.exe	RegAsm.exe
PID 928 wrote to memory of 1512	928	Updater-File.exe	RegAsm.exe
PID 928 wrote to memory of 1512	928	Updater-File.exe	RegAsm.exe
PID 1512 wrote to memory of 1552	1512	RegAsm.exe	cmd.exe
PID 1512 wrote to memory of 1552	1512	RegAsm.exe	cmd.exe
PID 1512 wrote to memory of 1552	1512	RegAsm.exe	cmd.exe
PID 1512 wrote to memory of 1552	1512	RegAsm.exe	cmd.exe
PID 1552 wrote to memory of 1772	1552	cmd.exe	chcp.com
PID 1552 wrote to memory of 1772	1552	cmd.exe	chcp.com
PID 1552 wrote to memory of 1772	1552	cmd.exe	chcp.com
PID 1552 wrote to memory of 1772	1552	cmd.exe	chcp.com
PID 1552 wrote to memory of 1072	1552	cmd.exe	PING.EXE
PID 1552 wrote to memory of 1072	1552	cmd.exe	PING.EXE
PID 1552 wrote to memory of 1072	1552	cmd.exe	PING.EXE
PID 1552 wrote to memory of 1072	1552	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\BLToolsMod.exe
"C:\Users\Admin\AppData\Local\Temp\BLToolsMod.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:532

C:\Users\Admin\AppData\Roaming\Updater-File.exe
"C:\Users\Admin\AppData\Roaming\Updater-File.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\1skF01T86D8g.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\chcp.com
chcp 65001
5⤵
PID:1772

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
5⤵
- Runs ping.exe
PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 1456
2⤵
- Program crash
PID:996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1skF01T86D8g.bat
Filesize
270B

MD5
42b8ed6afe608da6a252b8fefa1646f4

SHA1
38e671f7d13b927f2a896feabcd8471d138d7c7d

SHA256
4ae55012f9f6b335343b84eb3b4494486bde5f66f38fd0e2ed1b1435537d1fd3

SHA512
5071c7950b7ee459776e2830b32c429be2d2554cfd63c78a30453e0cadb56b5d71aae883f2beb1332dfe788f746be05116688b063ab6918154944d7dea90786d

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\02-05-~1
Filesize
224B

MD5
1272c8b533acd1cf96ee6a0caad8c9ad

SHA1
43131c6b3b4ba5b27fa4c4e1794913a89e5a548d

SHA256
5f7c96867d2136a5dbdcc9bfd145d221455306f0a8932fb7c3f49805fae375bb

SHA512
8266aaa7e8b06968e8754d7a823d777b953e6481a0b7fe1b19131165642417739ccb469f86a6d9b370404f47ab2ad254e2a4d1df93edd750c77412827749caf0

Download Submit
C:\Users\Admin\AppData\Roaming\Updater-File.exe
Filesize
6KB

MD5
be2c9d9f3e9206eb7d809157ea37d0ea

SHA1
79fc984efb6d9e58c21f7c5dee8de2fc44710f62

SHA256
f07ca31e483745ac9fe74da53f939a797f3f8868717eb29f9f0d1286b89f6b79

SHA512
2510583a2690be0c48614fa21d24c2919d6c4f704d897ed4bb5a523d0bbc3616bd2aba7a6b22120068a24aa756a9b6f37feeb2b8eb461b86c2eacde935478d4b

Download Submit
C:\Users\Admin\AppData\Roaming\Updater-File.exe
Filesize
6KB

MD5
be2c9d9f3e9206eb7d809157ea37d0ea

SHA1
79fc984efb6d9e58c21f7c5dee8de2fc44710f62

SHA256
f07ca31e483745ac9fe74da53f939a797f3f8868717eb29f9f0d1286b89f6b79

SHA512
2510583a2690be0c48614fa21d24c2919d6c4f704d897ed4bb5a523d0bbc3616bd2aba7a6b22120068a24aa756a9b6f37feeb2b8eb461b86c2eacde935478d4b

Download Submit
\Users\Admin\AppData\Roaming\Updater-File.exe
Filesize
6KB

MD5
be2c9d9f3e9206eb7d809157ea37d0ea

SHA1
79fc984efb6d9e58c21f7c5dee8de2fc44710f62

SHA256
f07ca31e483745ac9fe74da53f939a797f3f8868717eb29f9f0d1286b89f6b79

SHA512
2510583a2690be0c48614fa21d24c2919d6c4f704d897ed4bb5a523d0bbc3616bd2aba7a6b22120068a24aa756a9b6f37feeb2b8eb461b86c2eacde935478d4b

Download Submit
memory/532-57-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/532-65-0x0000000004A85000-0x0000000004A96000-memory.dmp

Filesize
68KB

Download
memory/532-56-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/532-55-0x0000000004AC0000-0x0000000004C16000-memory.dmp

Filesize
1.3MB

Download
memory/532-54-0x00000000003E0000-0x00000000004A4000-memory.dmp

Filesize
784KB

Download
memory/928-59-0x0000000000000000-mapping.dmp

Download
memory/928-72-0x0000000004F00000-0x0000000004F5E000-memory.dmp

Filesize
376KB

Download
memory/928-62-0x0000000000E60000-0x0000000000E68000-memory.dmp

Filesize
32KB

Download
memory/928-66-0x0000000007430000-0x000000000769E000-memory.dmp

Filesize
2.4MB

Download
memory/996-64-0x0000000000000000-mapping.dmp

Download
memory/1072-88-0x0000000000000000-mapping.dmp

Download
memory/1512-79-0x00000000004494BE-mapping.dmp

Download
memory/1512-78-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1512-74-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1512-76-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1512-77-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1512-83-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1512-81-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1512-73-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1552-85-0x0000000000000000-mapping.dmp

Download
memory/1772-87-0x0000000000000000-mapping.dmp

Download
memory/1912-71-0x000000006C9E0000-0x000000006CF8B000-memory.dmp

Filesize
5.7MB

Download
memory/1912-70-0x000000006C9E0000-0x000000006CF8B000-memory.dmp

Filesize
5.7MB

Download
memory/1912-69-0x000000006C9E0000-0x000000006CF8B000-memory.dmp

Filesize
5.7MB

Download
memory/1912-67-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads