purecrypter | 5d566dfc59fc59261a8eeb61d60bbd84b6401a597a48eb56e19005c7f4178d03 | Triage

Analysis

max time kernel
94s
max time network
98s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 13:56

Sharing

Report Analysis Logs

General

Target

00000000.exe
Size

118KB
MD5

2a82b70ea720502bc8ad123ee446ec4c
SHA1

b330307db7ef87683721d7eb4ebe007d1b41826c
SHA256

5d566dfc59fc59261a8eeb61d60bbd84b6401a597a48eb56e19005c7f4178d03
SHA512

377cb36a3822b2227485a1ccbd8c83a41029c4316ac1070437b997bfbb37c3bfd4c99ed7dbb370c285f026beb63fd1179c2c7805bb089f72971dd00b1d7f4c73
SSDEEP

1536:z+p+iPNAL0z81YHKDgnkt9tMDyC+9BDYz39:zOvFRCgkIDyt9BDk39

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

C2

http://justnormalsite.ddns.net/SystemEnv/uploads/nodeffender_Veiwqhsq.jpg

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	2032	WerFault.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	00000000.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1740	2032	00000000.exe	26
PID 2032 wrote to memory of 1740	2032	00000000.exe	26
PID 2032 wrote to memory of 1740	2032	00000000.exe	26
PID 2032 wrote to memory of 1740	2032	00000000.exe	26

C:\Users\Admin\AppData\Local\Temp\00000000.exe
"C:\Users\Admin\AppData\Local\Temp\00000000.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1200
  2⤵
  - Program crash
  PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-54-0x0000000000B80000-0x0000000000BA4000-memory.dmp

Filesize
144KB

Download
memory/2032-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download