purecrypter | 74fadfd0039df927ba6ee5cfa3b6cae8848146b0725b1efe3d00e11384f46a93

General

Target

Hogwarts Legacy by Empress.rar
Size

29.7MB
MD5

75501e17ea7127a3580a5617a33556ea
SHA1

03a41a82643aff68c5f3e5a2308fdf3019155a94
SHA256

74fadfd0039df927ba6ee5cfa3b6cae8848146b0725b1efe3d00e11384f46a93
SHA512

c76dc7f8d0f5f809024ef59bd26abfb21b54478133e8ad8f3117f9762e96532b109848a35ea798952f4138cbe0cba25571ec8c030cf3fd7d36c18c4fdac31371
SSDEEP

786432:st2vfAqmU9xAAP+wKYvAb314QQ4VUqTjCG0JuHPyOL8azdR:sGnxY732QQ4VleGbyO7zj

Score

10^/10

purecrypter downloader loader persistence

Malware Config

Extracted

Family

purecrypter

C2

http://comicmaster.org.uk/img/css/design/fabric/bo/Kvxut.dat

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	setupov16.exe

Executes dropped EXE 2 IoCs

pid	Process
3728	Hogwarts Legacy by Empress.exe
2976	setupov16.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	Hogwarts Legacy by Empress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Hogwarts Legacy by Empress.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3352	powershell.exe
3352	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2156	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4608	7zG.exe
Token: 35	4608	7zG.exe
Token: SeSecurityPrivilege	4608	7zG.exe
Token: SeSecurityPrivilege	4608	7zG.exe
Token: SeDebugPrivilege	2976	setupov16.exe
Token: SeDebugPrivilege	3352	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4608	7zG.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
2156	OpenWith.exe
3728	Hogwarts Legacy by Empress.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 2976	3728	Hogwarts Legacy by Empress.exe	92
PID 3728 wrote to memory of 2976	3728	Hogwarts Legacy by Empress.exe	92
PID 3728 wrote to memory of 2976	3728	Hogwarts Legacy by Empress.exe	92
PID 2976 wrote to memory of 3352	2976	setupov16.exe	97
PID 2976 wrote to memory of 3352	2976	setupov16.exe	97
PID 2976 wrote to memory of 3352	2976	setupov16.exe	97

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Hogwarts Legacy by Empress.rar"
1⤵
- Modifies registry class
PID:4932

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2864

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Hogwarts Legacy by Empress\" -spe -an -ai#7zMap5387:132:7zEvent32396
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4608

C:\Users\Admin\AppData\Local\Temp\Hogwarts Legacy by Empress\Hogwarts Legacy by Empress\Hogwarts Legacy by Empress.exe
"C:\Users\Admin\AppData\Local\Temp\Hogwarts Legacy by Empress\Hogwarts Legacy by Empress\Hogwarts Legacy by Empress.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov16.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov16.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Hogwarts Legacy by Empress\Hogwarts Legacy by Empress\Hogwarts Legacy by Empress.exe

Filesize
608.2MB

MD5
bfa972c3534bb9b657d49286c2869e45

SHA1
5830157f8d61333cd1cb501c10add55d17980a65

SHA256
60dbb61c6ba079ac1e03937a8b61269bb74a7ca4f387be6498475f4895ec7c10

SHA512
82e081bc33632d29ae32e233f33ac540c2fa6c1d3e689161a25f642b23ac8dae8db10a5b288ba4e09585ffe99e31fdc41c3f909c737d2d3f2f1903cb4ebeae4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hogwarts Legacy by Empress\Hogwarts Legacy by Empress\Hogwarts Legacy by Empress.exe

Filesize
610.6MB

MD5
6971ac9427c29e41f85fea57a74660be

SHA1
02e2462f60535766bacddc8da6bf831ad0a906f4

SHA256
bdf0059bbae30869406084ebd8e4df69d97ff1bbb2f2f4df14bc5b76ff429d3a

SHA512
9859c0d4a0d838c3619557e96affbb752d8019a5739601313c66e167ee819d331c06b41d4c5a27c6096ab5fe4ab5c1a4cd78d5d75049037ad6986094a6e6eb0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov16.exe

Filesize
320.3MB

MD5
fe173c5ead5bb311298237f4f5c86998

SHA1
cb65e2d7d18b0390b679ad8201480adf860695f4

SHA256
de35d952cf71a1e17bef8142462152394842157a28ba0f50e407521c4b565015

SHA512
d78f6f94d28a9d116353a5e192d0051ddc4dd4e4e9e0a19bf7b01dff303ad760f79574f281055f14da9102fdbfea0a812ef20b7129fa0e5575e6386d61dd02c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov16.exe

Filesize
292.4MB

MD5
77b8943eba9ade47b5ba63049bed89c2

SHA1
150b5881d24c5c72153aa6907cd647c706bb0ab4

SHA256
a6b39ebf36f6cdb14f610b519f387e4efb4ecc5458d50f8ab49ab842a42a47ec

SHA512
8c96a61581eb432abec194adc0e8013ba350df1d9c3c949ab416e13fb0bf19b17385af9301794b2ec7b228283ecdcbf19e854c1d772735c6d74f052e897ccf26

Download Submit
memory/2976-138-0x00000000063A0000-0x00000000063C2000-memory.dmp

Filesize
136KB

Download
memory/2976-137-0x0000000000870000-0x0000000000878000-memory.dmp

Filesize
32KB

Download
memory/3352-140-0x0000000002D90000-0x0000000002DC6000-memory.dmp

Filesize
216KB

Download
memory/3352-141-0x0000000005410000-0x0000000005A38000-memory.dmp

Filesize
6.2MB

Download
memory/3352-142-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Filesize
408KB

Download
memory/3352-143-0x0000000005E50000-0x0000000005EB6000-memory.dmp

Filesize
408KB

Download
memory/3352-144-0x00000000050B0000-0x00000000050CE000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing