Overview

overview

10

Static

static

10

00000000.exe

windows7-x64

10

00000000.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    98s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-02-2023 13:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    00000000.exe

  • Size

    118KB

  • MD5

    2a82b70ea720502bc8ad123ee446ec4c

  • SHA1

    b330307db7ef87683721d7eb4ebe007d1b41826c

  • SHA256

    5d566dfc59fc59261a8eeb61d60bbd84b6401a597a48eb56e19005c7f4178d03

  • SHA512

    377cb36a3822b2227485a1ccbd8c83a41029c4316ac1070437b997bfbb37c3bfd4c99ed7dbb370c285f026beb63fd1179c2c7805bb089f72971dd00b1d7f4c73

  • SSDEEP

    1536:z+p+iPNAL0z81YHKDgnkt9tMDyC+9BDYz39:zOvFRCgkIDyt9BDk39

Score
10/10
purecrypterdownloaderloader

Malware Config

Extracted

Family

purecrypter

C2

http://justnormalsite.ddns.net/SystemEnv/uploads/nodeffender_Veiwqhsq.jpg

Signatures

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00000000.exe
    "C:\Users\Admin\AppData\Local\Temp\00000000.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4260
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 1696
      2⤵
      • Program crash
      PID:4940
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4260 -ip 4260
    1⤵
      PID:4916

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4260-132-0x0000000000730000-0x0000000000754000-memory.dmp

      Filesize

      144KB

      Download