purecrypter | 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6

Analysis

max time kernel
103s
max time network
91s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-02-2023 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BLToolsMod.exe
Size

763KB
MD5

869037e716218fb7551d84b8ce7d0ae7
SHA1

12cb776519eeb2d5e6a7ab1ddce3a09f143d5f18
SHA256

305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6
SHA512

6840e10d1daeacd169dba4a0049bc3b9087726dd45551b9a9587d57ec45d926356ce1656a39fdf35c1acb4020c564ec1f6a910fd83cde99e3ff75195728c72d2
SSDEEP

12288:SAZdPU5ttcsREhy5IYU8OaNISOvsk0gnT467zpmw7OfimWm/YfdFxfJ:S2UVc+EhyuAOaNIBXnT46fpmiOfimWy4

Score

10^/10

purecrypter quasar revengerat office04 downloader loader persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office04

youhackernetpaingodxd.duckdns.org:5557

blablashitspreading.ddns.net:5557

Mutex

xEoEv3HHdyEIYwJRFM

Attributes

encryption_key
w3WfcmWh1iXT9cxeKFEX
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Detect PureCrypter injector 1 IoCs

loader

resource	yara_rule
behavioral1/memory/320-66-0x0000000007170000-0x00000000073DE000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

resource	yara_rule
behavioral1/memory/1744-77-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/1744-76-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/1744-78-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/1744-79-0x00000000004494BE-mapping.dmp	family_quasar
behavioral1/memory/1744-81-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar
behavioral1/memory/1744-83-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
320	Updater-File.exe

Loads dropped DLL 1 IoCs

pid	Process
2032	BLToolsMod.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Driver.exe\""	Updater-File.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 320 set thread context of 1744	320	Updater-File.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	2032	WerFault.exe	25

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1868	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
960	powershell.exe
320	Updater-File.exe
320	Updater-File.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	BLToolsMod.exe
Token: SeDebugPrivilege	320	Updater-File.exe
Token: SeDebugPrivilege	960	powershell.exe
Token: SeDebugPrivilege	1744	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1744	RegAsm.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 320	2032	BLToolsMod.exe	26
PID 2032 wrote to memory of 320	2032	BLToolsMod.exe	26
PID 2032 wrote to memory of 320	2032	BLToolsMod.exe	26
PID 2032 wrote to memory of 320	2032	BLToolsMod.exe	26
PID 2032 wrote to memory of 320	2032	BLToolsMod.exe	26
PID 2032 wrote to memory of 320	2032	BLToolsMod.exe	26
PID 2032 wrote to memory of 320	2032	BLToolsMod.exe	26
PID 2032 wrote to memory of 1720	2032	BLToolsMod.exe	27
PID 2032 wrote to memory of 1720	2032	BLToolsMod.exe	27
PID 2032 wrote to memory of 1720	2032	BLToolsMod.exe	27
PID 2032 wrote to memory of 1720	2032	BLToolsMod.exe	27
PID 320 wrote to memory of 960	320	Updater-File.exe	28
PID 320 wrote to memory of 960	320	Updater-File.exe	28
PID 320 wrote to memory of 960	320	Updater-File.exe	28
PID 320 wrote to memory of 960	320	Updater-File.exe	28
PID 320 wrote to memory of 1916	320	Updater-File.exe	30
PID 320 wrote to memory of 1916	320	Updater-File.exe	30
PID 320 wrote to memory of 1916	320	Updater-File.exe	30
PID 320 wrote to memory of 1916	320	Updater-File.exe	30
PID 320 wrote to memory of 1916	320	Updater-File.exe	30
PID 320 wrote to memory of 1916	320	Updater-File.exe	30
PID 320 wrote to memory of 1916	320	Updater-File.exe	30
PID 320 wrote to memory of 1744	320	Updater-File.exe	31
PID 320 wrote to memory of 1744	320	Updater-File.exe	31
PID 320 wrote to memory of 1744	320	Updater-File.exe	31
PID 320 wrote to memory of 1744	320	Updater-File.exe	31
PID 320 wrote to memory of 1744	320	Updater-File.exe	31
PID 320 wrote to memory of 1744	320	Updater-File.exe	31
PID 320 wrote to memory of 1744	320	Updater-File.exe	31
PID 320 wrote to memory of 1744	320	Updater-File.exe	31
PID 320 wrote to memory of 1744	320	Updater-File.exe	31
PID 320 wrote to memory of 1744	320	Updater-File.exe	31
PID 320 wrote to memory of 1744	320	Updater-File.exe	31
PID 320 wrote to memory of 1744	320	Updater-File.exe	31
PID 1744 wrote to memory of 1120	1744	RegAsm.exe	33
PID 1744 wrote to memory of 1120	1744	RegAsm.exe	33
PID 1744 wrote to memory of 1120	1744	RegAsm.exe	33
PID 1744 wrote to memory of 1120	1744	RegAsm.exe	33
PID 1120 wrote to memory of 560	1120	cmd.exe	35
PID 1120 wrote to memory of 560	1120	cmd.exe	35
PID 1120 wrote to memory of 560	1120	cmd.exe	35
PID 1120 wrote to memory of 560	1120	cmd.exe	35
PID 1120 wrote to memory of 1868	1120	cmd.exe	36
PID 1120 wrote to memory of 1868	1120	cmd.exe	36
PID 1120 wrote to memory of 1868	1120	cmd.exe	36
PID 1120 wrote to memory of 1868	1120	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\BLToolsMod.exe
"C:\Users\Admin\AppData\Local\Temp\BLToolsMod.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Roaming\Updater-File.exe
  "C:\Users\Admin\AppData\Roaming\Updater-File.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:960
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    3⤵
    PID:1916
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\llPH3dV70tF2.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1120
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:560
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:1868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1448
  2⤵
  - Program crash
  PID:1720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\llPH3dV70tF2.bat

Filesize
270B

MD5
46a5e159f52adba19d306438a2d5eb72

SHA1
821260a538d3771a0ebb11f895697331a96daa35

SHA256
100273d3faefb83389d2db3b89aae8dadeb574c74776ade730faf9d9a0239933

SHA512
0c42da43a85388d85bf187406145e0336755f94a324e11c45e2730c288a47c74fa5d9bdccdcd31302df1042ccb9e666e3b3d3d5e2767506f499136b50996f7fc

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\02-05-~1

Filesize
224B

MD5
fd010ea1b3798c5a0f9fd1494e508383

SHA1
340015cc251ac5897f00b945152cc3ca9e28cae3

SHA256
39d4c767e2fd899411f963eb23a06f531e7b65c6f2eb02db09dbb116a2dc7fee

SHA512
39d6d2cfcea4bf213ecb891e382951edd33f1c7722fa1a2051f31628ade3d5cb829864d9c5044cc40ff8363989324096d35ea9261dc9ca12d9b8ac8814d9832a

Download Submit
C:\Users\Admin\AppData\Roaming\Updater-File.exe

Filesize
6KB

MD5
be2c9d9f3e9206eb7d809157ea37d0ea

SHA1
79fc984efb6d9e58c21f7c5dee8de2fc44710f62

SHA256
f07ca31e483745ac9fe74da53f939a797f3f8868717eb29f9f0d1286b89f6b79

SHA512
2510583a2690be0c48614fa21d24c2919d6c4f704d897ed4bb5a523d0bbc3616bd2aba7a6b22120068a24aa756a9b6f37feeb2b8eb461b86c2eacde935478d4b

Download Submit
C:\Users\Admin\AppData\Roaming\Updater-File.exe

Filesize
6KB

MD5
be2c9d9f3e9206eb7d809157ea37d0ea

SHA1
79fc984efb6d9e58c21f7c5dee8de2fc44710f62

SHA256
f07ca31e483745ac9fe74da53f939a797f3f8868717eb29f9f0d1286b89f6b79

SHA512
2510583a2690be0c48614fa21d24c2919d6c4f704d897ed4bb5a523d0bbc3616bd2aba7a6b22120068a24aa756a9b6f37feeb2b8eb461b86c2eacde935478d4b

Download Submit
\Users\Admin\AppData\Roaming\Updater-File.exe

Filesize
6KB

MD5
be2c9d9f3e9206eb7d809157ea37d0ea

SHA1
79fc984efb6d9e58c21f7c5dee8de2fc44710f62

SHA256
f07ca31e483745ac9fe74da53f939a797f3f8868717eb29f9f0d1286b89f6b79

SHA512
2510583a2690be0c48614fa21d24c2919d6c4f704d897ed4bb5a523d0bbc3616bd2aba7a6b22120068a24aa756a9b6f37feeb2b8eb461b86c2eacde935478d4b

Download Submit
memory/320-66-0x0000000007170000-0x00000000073DE000-memory.dmp

Filesize
2.4MB

Download
memory/320-62-0x0000000000A60000-0x0000000000A68000-memory.dmp

Filesize
32KB

Download
memory/320-72-0x0000000004EA0000-0x0000000004EFE000-memory.dmp

Filesize
376KB

Download
memory/960-70-0x000000006CB30000-0x000000006D0DB000-memory.dmp

Filesize
5.7MB

Download
memory/960-69-0x000000006CB30000-0x000000006D0DB000-memory.dmp

Filesize
5.7MB

Download
memory/960-71-0x000000006CB30000-0x000000006D0DB000-memory.dmp

Filesize
5.7MB

Download
memory/1744-77-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1744-81-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1744-74-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1744-83-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1744-76-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1744-78-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1744-73-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2032-65-0x0000000000475000-0x0000000000486000-memory.dmp

Filesize
68KB

Download
memory/2032-54-0x0000000000390000-0x0000000000454000-memory.dmp

Filesize
784KB

Download
memory/2032-57-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2032-56-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2032-55-0x0000000006EB0000-0x0000000007006000-memory.dmp

Filesize
1.3MB

Download