Analysis
-
max time kernel
39s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
07-02-2023 00:34
General
-
Target
5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe
-
Size
350.1MB
-
MD5
0180decb30ec5d3934893c90995b2aca
-
SHA1
181cf9bd4aaa5e0fc3e329f72a32e5fdb5af2e67
-
SHA256
5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d
-
SHA512
2edada0d787ca09745a74c4ff9a1c4c6346b72ea544d3d2fab5f5909b190e19f1fd0494bc7c3d5bb972d1c9199a49267d21eac57c5413d65a333a4ea0067e58a
-
SSDEEP
1536:z+p+iPNAL0z81YHKDgnkt9tMDyC+9BDYz39A:zOvFRCgkIDyt9BDk39A
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
http://justnormalsite.ddns.net/SystemEnv/uploads/nodeffender_Veiwqhsq.jpg
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe"C:\Users\Admin\AppData\Local\Temp\5d649c5aa230376f1a08074aee91129b8031606856e9b4b6c6d0387f35f6629d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 12082⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/748-56-0x0000000000000000-mapping.dmp
-
memory/1724-54-0x0000000001150000-0x0000000001174000-memory.dmpFilesize
144KB
-
memory/1724-55-0x0000000075111000-0x0000000075113000-memory.dmpFilesize
8KB