purecrypter | 0492e86e9f32847a07e11519c5833035b85a85473777de0c1c558e53a019e3c0

Analysis

max time kernel
299s
max time network
301s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
07-02-2023 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mhiwfmlub.exe
Size

446KB
MD5

c4869d1471e76a3efa87816ad5ebfec3
SHA1

dd0cc24265371721bd1eb383ce3f460081074763
SHA256

92767f44cc14eeed6919d8b3c214d63d1e9fb72439d9f6a662a4a595d8512b3b
SHA512

1b664fd1eca97d224d64d4d050cdba3a8cebc8fa51c2bc59640ea5eb46e1352cc65cc51c8aab7ee5ea2e9e70f803325fb87f2188e55caf84f227252396542fc0
SSDEEP

12288:BBJooIJUl95lJVfWkAy2KcwsDInlhm3tur8KgQUg:HyVgXlJ9WkAf5Ibm9u4oUg

Score

10^/10

purecrypter remcos mimiboy downloader loader persistence rat

Malware Config

Extracted

Family

remcos

Version

2.7.1 Pro

Botnet

MIMIBOY

91.231.84.41:52651

127.0.0.1:52651

10.5.175.21:52651

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-SURYWD
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Detect PureCrypter injector 1 IoCs

loader

Processes:

resource	yara_rule
behavioral2/memory/2344-160-0x0000000004AA0000-0x0000000004B10000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Mhiwfmlub.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cjkftmvp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Znpyrvobkvt\\Cjkftmvp.exe\""	Mhiwfmlub.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Mhiwfmlub.exe

description pid process target process

PID 2344 set thread context of 4900 2344 Mhiwfmlub.exe Mhiwfmlub.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

2172 powershell.exe
2172 powershell.exe
2172 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeMhiwfmlub.exe

description pid process

Token: SeDebugPrivilege 2172 powershell.exe
Token: SeDebugPrivilege 2344 Mhiwfmlub.exe

description	pid	process	target process
PID 2344 set thread context of 4900	2344	Mhiwfmlub.exe	Mhiwfmlub.exe

pid	process
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	2344	Mhiwfmlub.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Mhiwfmlub.exe

description	pid	process	target process
PID 2344 wrote to memory of 2172	2344	Mhiwfmlub.exe	powershell.exe
PID 2344 wrote to memory of 2172	2344	Mhiwfmlub.exe	powershell.exe
PID 2344 wrote to memory of 2172	2344	Mhiwfmlub.exe	powershell.exe
PID 2344 wrote to memory of 4900	2344	Mhiwfmlub.exe	Mhiwfmlub.exe
PID 2344 wrote to memory of 4900	2344	Mhiwfmlub.exe	Mhiwfmlub.exe
PID 2344 wrote to memory of 4900	2344	Mhiwfmlub.exe	Mhiwfmlub.exe
PID 2344 wrote to memory of 4900	2344	Mhiwfmlub.exe	Mhiwfmlub.exe
PID 2344 wrote to memory of 4900	2344	Mhiwfmlub.exe	Mhiwfmlub.exe
PID 2344 wrote to memory of 4900	2344	Mhiwfmlub.exe	Mhiwfmlub.exe
PID 2344 wrote to memory of 4900	2344	Mhiwfmlub.exe	Mhiwfmlub.exe
PID 2344 wrote to memory of 4900	2344	Mhiwfmlub.exe	Mhiwfmlub.exe
PID 2344 wrote to memory of 4900	2344	Mhiwfmlub.exe	Mhiwfmlub.exe
PID 2344 wrote to memory of 4900	2344	Mhiwfmlub.exe	Mhiwfmlub.exe

C:\Users\Admin\AppData\Local\Temp\Mhiwfmlub.exe
"C:\Users\Admin\AppData\Local\Temp\Mhiwfmlub.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Users\Admin\AppData\Local\Temp\Mhiwfmlub.exe
C:\Users\Admin\AppData\Local\Temp\Mhiwfmlub.exe
2⤵
PID:4900

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-188-0x0000000000000000-mapping.dmp

Download
memory/2172-189-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2172-224-0x0000000000F30000-0x0000000000F66000-memory.dmp

Filesize
216KB

Download
memory/2172-229-0x0000000006F80000-0x00000000075A8000-memory.dmp

Filesize
6.2MB

Download
memory/2172-248-0x0000000006E80000-0x0000000006EE6000-memory.dmp

Filesize
408KB

Download
memory/2172-269-0x0000000008CB0000-0x0000000008CCA000-memory.dmp

Filesize
104KB

Download
memory/2172-268-0x0000000009580000-0x0000000009BF8000-memory.dmp

Filesize
6.5MB

Download
memory/2172-257-0x0000000007E30000-0x0000000007EA6000-memory.dmp

Filesize
472KB

Download
memory/2172-253-0x00000000080C0000-0x000000000810B000-memory.dmp

Filesize
300KB

Download
memory/2172-252-0x0000000007810000-0x000000000782C000-memory.dmp

Filesize
112KB

Download
memory/2172-249-0x0000000006F00000-0x0000000006F66000-memory.dmp

Filesize
408KB

Download
memory/2344-153-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-159-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-126-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-127-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-128-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-129-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-130-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-131-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-132-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-133-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-134-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-135-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-136-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-137-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-138-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-139-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-140-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-141-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-142-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-143-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-144-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-145-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-146-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-147-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-148-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-149-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-150-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-151-0x00000000002A0000-0x0000000000316000-memory.dmp

Filesize
472KB

Download
memory/2344-152-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-124-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-154-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-155-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-156-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-157-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-158-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-125-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-160-0x0000000004AA0000-0x0000000004B10000-memory.dmp

Filesize
448KB

Download
memory/2344-161-0x00000000051A0000-0x000000000569E000-memory.dmp

Filesize
5.0MB

Download
memory/2344-162-0x0000000004BD0000-0x0000000004C62000-memory.dmp

Filesize
584KB

Download
memory/2344-163-0x0000000004CA0000-0x0000000004D32000-memory.dmp

Filesize
584KB

Download
memory/2344-164-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-165-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-166-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-167-0x0000000004D80000-0x0000000004DA2000-memory.dmp

Filesize
136KB

Download
memory/2344-168-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-169-0x0000000004DB0000-0x0000000005100000-memory.dmp

Filesize
3.3MB

Download
memory/2344-170-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-171-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-172-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-173-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-174-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-175-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-176-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-177-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-178-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-179-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-180-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-181-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-182-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-123-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-122-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-121-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-120-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-119-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-118-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-183-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-184-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-185-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-186-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/2344-187-0x00000000770E0000-0x000000007726E000-memory.dmp

Filesize
1.6MB

Download
memory/4900-277-0x0000000000413FA4-mapping.dmp

Download
memory/4900-330-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download