purecrypter | bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7

Analysis

max time kernel
224s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10/02/2023, 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

swift_09_feb_2023_usd_42019347593691658483-37497169570422045546309802-2379924.exe
Size

11KB
MD5

14fec5297bef8c5fa6d3f0f5934dea32
SHA1

5549beb12b3635e878b174ae93d47a147e2f6d98
SHA256

bc080be46ac6e8aaff225091e2afdb6074fed20e30d30e1ad018f58a1e1901b7
SHA512

a7889770f7bed2ed2aff36c67cda577cd0ebc064c93532d425d0207bb60f55ee474d6e433402b86704d3f80e442209df53f0bd885d5fcd72b5b229ff5697fda6
SSDEEP

192:cliHh1RDurJEC+88OSM4+pmqQcNM2YDM:cG1d2JEC+lKFI

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

https://vinosbiodinamicos.com/Wnsixjk.bmp

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	swift_09_feb_2023_usd_42019347593691658483-37497169570422045546309802-2379924.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5084	powershell.exe
5084	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	swift_09_feb_2023_usd_42019347593691658483-37497169570422045546309802-2379924.exe
Token: SeDebugPrivilege	5084	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 5084	2292	swift_09_feb_2023_usd_42019347593691658483-37497169570422045546309802-2379924.exe	80
PID 2292 wrote to memory of 5084	2292	swift_09_feb_2023_usd_42019347593691658483-37497169570422045546309802-2379924.exe	80
PID 2292 wrote to memory of 5084	2292	swift_09_feb_2023_usd_42019347593691658483-37497169570422045546309802-2379924.exe	80

C:\Users\Admin\AppData\Local\Temp\swift_09_feb_2023_usd_42019347593691658483-37497169570422045546309802-2379924.exe
"C:\Users\Admin\AppData\Local\Temp\swift_09_feb_2023_usd_42019347593691658483-37497169570422045546309802-2379924.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANAA3AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2292-132-0x0000000000730000-0x0000000000738000-memory.dmp

Filesize
32KB

Download
memory/2292-133-0x00000000054C0000-0x0000000005A64000-memory.dmp

Filesize
5.6MB

Download
memory/2292-134-0x0000000005230000-0x00000000052C2000-memory.dmp

Filesize
584KB

Download
memory/2292-135-0x0000000000F10000-0x0000000000F32000-memory.dmp

Filesize
136KB

Download
memory/5084-137-0x0000000003080000-0x00000000030B6000-memory.dmp

Filesize
216KB

Download
memory/5084-138-0x0000000005850000-0x0000000005E78000-memory.dmp

Filesize
6.2MB

Download
memory/5084-139-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Filesize
408KB

Download
memory/5084-140-0x0000000006050000-0x00000000060B6000-memory.dmp

Filesize
408KB

Download
memory/5084-141-0x0000000006660000-0x000000000667E000-memory.dmp

Filesize
120KB

Download