purecrypter | c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b

General

Target

c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe
Size

1.3MB
MD5

f1c29ba01377c35e6f920f0aa626eaf5
SHA1

7b2c191bc2d5d549c5e65613f93d59ece1842f02
SHA256

c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b
SHA512

449a9d0ec42f83be09ef7a258f50f3d07728bb9f06361dc4aebdcbcce0ca010a3c894a5d27d98f197d6b4b85be4e3639656ae75a0216e8e169c54717ad2a85f0
SSDEEP

24576:hT+ua8m657w6ZBLmkitKqBCjC0PDgM5AVnipXD1Z+7:hcVV1BCjBG2

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

C2

https://cents-ability.org/loader/uploads/noicon_Ujizjydo.bmp

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Executes dropped EXE 2 IoCs

pid	Process
1140	noicon.exe
1516	Stearler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
528	powershell.exe
1740	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	noicon.exe
Token: SeDebugPrivilege	528	powershell.exe
Token: SeDebugPrivilege	1740	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 1140	1472	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	27
PID 1472 wrote to memory of 1140	1472	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	27
PID 1472 wrote to memory of 1140	1472	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	27
PID 1472 wrote to memory of 1140	1472	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	27
PID 1472 wrote to memory of 1516	1472	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	28
PID 1472 wrote to memory of 1516	1472	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	28
PID 1472 wrote to memory of 1516	1472	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	28
PID 1472 wrote to memory of 1516	1472	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	28
PID 1472 wrote to memory of 1928	1472	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	29
PID 1472 wrote to memory of 1928	1472	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	29
PID 1472 wrote to memory of 1928	1472	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	29
PID 1516 wrote to memory of 468	1516	Stearler.exe	31
PID 1516 wrote to memory of 468	1516	Stearler.exe	31
PID 1516 wrote to memory of 468	1516	Stearler.exe	31
PID 1516 wrote to memory of 468	1516	Stearler.exe	31
PID 468 wrote to memory of 528	468	cmd.exe	33
PID 468 wrote to memory of 528	468	cmd.exe	33
PID 468 wrote to memory of 528	468	cmd.exe	33
PID 468 wrote to memory of 528	468	cmd.exe	33
PID 468 wrote to memory of 1740	468	cmd.exe	34
PID 468 wrote to memory of 1740	468	cmd.exe	34
PID 468 wrote to memory of 1740	468	cmd.exe	34
PID 468 wrote to memory of 1740	468	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe
"C:\Users\Admin\AppData\Local\Temp\c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Users\Administrator\Desktop\DROP\noicon.exe
  "C:\Users\Administrator\Desktop\DROP\noicon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- C:\Users\Administrator\Desktop\DROP\Stearler.exe
  "C:\Users\Administrator\Desktop\DROP\Stearler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\7zS3515.tmp\Testobfusc.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep bypass -w hidden -Command Add-MpPreference -ExclusionExtension ".vbs"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:528
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep bypass -w hidden -Command Add-MpPreference -ExclusionPath "C:\Users\Public\Downloads"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1740
- C:\Windows\system32\cmd.exe
  "cmd.exe"
  2⤵
  PID:1928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS3515.tmp\Testobfusc.bat

Filesize
14KB

MD5
40e65da3d99568737a62d30060539f23

SHA1
c5b616eb054a850b019da2d19e42b82575a269c1

SHA256
a9ea79963c53c3756fc752d4a2978a86de6038fc728fabc200bc87cd938406e5

SHA512
ef19c1001097545955c2d4c3de48bcda7633459577cf3f54653ae0c89fea5e61e763645bdcd2027c303522c98a02893df1f7195b3d26d38a808e7cc78a5c325d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
e930e0a38dba218ca046f902d8f46236

SHA1
2a1de447462cf325a4322d5998bc922a04b799ed

SHA256
8dd0abe2365d0eedfeaee1dfe458ca3e9d7002769f142f18c7394b838d0ed27d

SHA512
77ce78750b368ea05f5e09bb519b4ce9166687416669124db467748b8a0dd6c3102750a073b9b4e24104a227e3a7f5819f7b27c91b56ed17c88985c44220524d

Download Submit
C:\Users\Administrator\Desktop\DROP\Stearler.exe

Filesize
127KB

MD5
c07c33c5e7c12107f2788280ad31c391

SHA1
8e14f012e98c39d6b20fe14a7532f299e5c001a0

SHA256
389b207183e0ea0fbc4beac9155486c5e6641d20aebd49eeaaa360dde72b7967

SHA512
8109a67532de5e35036680b66e2bdf06aa5067f1e601c4cf46f4c21721dc9dc3b2a65fcb77e01b74fa4246e1121ee058d81e8ec20c71dd8a2d906a73af88b0a1

Download Submit
C:\Users\Administrator\Desktop\DROP\Stearler.exe

Filesize
127KB

MD5
c07c33c5e7c12107f2788280ad31c391

SHA1
8e14f012e98c39d6b20fe14a7532f299e5c001a0

SHA256
389b207183e0ea0fbc4beac9155486c5e6641d20aebd49eeaaa360dde72b7967

SHA512
8109a67532de5e35036680b66e2bdf06aa5067f1e601c4cf46f4c21721dc9dc3b2a65fcb77e01b74fa4246e1121ee058d81e8ec20c71dd8a2d906a73af88b0a1

Download Submit
C:\Users\Administrator\Desktop\DROP\noicon.exe

Filesize
16.0MB

MD5
fdd4cd11d278dab26c2c8551e006c4ed

SHA1
f0ef434d38fa11f8bc38cbc90874ca582867b214

SHA256
80d4414ca76e050007cb39c7fb598e1828ad168bea5725fb5466ee9388d6fa05

SHA512
9333eaba36a12bb0ab260c553bbed6ddb872fc42b05a2cf3552702c298b3d01d653467a00caa1b5232e9a828dce3810e67e08d1f2e245e4356248bf337fb96bb

Download Submit
C:\Users\Administrator\Desktop\DROP\noicon.exe

Filesize
16.0MB

MD5
fdd4cd11d278dab26c2c8551e006c4ed

SHA1
f0ef434d38fa11f8bc38cbc90874ca582867b214

SHA256
80d4414ca76e050007cb39c7fb598e1828ad168bea5725fb5466ee9388d6fa05

SHA512
9333eaba36a12bb0ab260c553bbed6ddb872fc42b05a2cf3552702c298b3d01d653467a00caa1b5232e9a828dce3810e67e08d1f2e245e4356248bf337fb96bb

Download Submit
memory/528-71-0x000000006F610000-0x000000006FBBB000-memory.dmp

Filesize
5.7MB

Download
memory/528-72-0x000000006F610000-0x000000006FBBB000-memory.dmp

Filesize
5.7MB

Download
memory/1140-60-0x00000000003F0000-0x00000000003F8000-memory.dmp

Filesize
32KB

Download
memory/1472-54-0x0000000000A60000-0x0000000000BA8000-memory.dmp

Filesize
1.3MB

Download
memory/1472-56-0x0000000000430000-0x00000000004E0000-memory.dmp

Filesize
704KB

Download
memory/1472-55-0x0000000000150000-0x0000000000194000-memory.dmp

Filesize
272KB

Download
memory/1516-63-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1740-76-0x000000006F060000-0x000000006F60B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing