purecrypter | 6f18c519197668bbf6db0fe9bf290d3d38d656f0c197e3a02cd6018ef5477991 | Triage

Analysis

max time kernel
100s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18-02-2023 16:05

Sharing

Report Analysis Logs

General

Target

file.exe
Size

195KB
MD5

d749a68e8a626d1fa86c707999e19828
SHA1

5e1fdde69d8d018b712e2d86b1bc0b664477dfd9
SHA256

6f18c519197668bbf6db0fe9bf290d3d38d656f0c197e3a02cd6018ef5477991
SHA512

d28609a3aba8376c24c2dda9810d5ba01a7d1503f1aaa930ee127d700339c2bbb45d4f94e24ee4333ef5884489733f60df751ce4a8d446bcb5169cd1292a0f88
SSDEEP

1536:KMDOTOoIaNlrxCka5SjXKT/aoA2O6zaTlz5vF:KMaDzVKSbKT/aoA2naz

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

C2

http://rssh.li/panel/uploads/Jnjztslzr.png

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1020	1808	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	file.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1020	1808	file.exe	27
PID 1808 wrote to memory of 1020	1808	file.exe	27
PID 1808 wrote to memory of 1020	1808	file.exe	27
PID 1808 wrote to memory of 1020	1808	file.exe	27

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 1220
  2⤵
  - Program crash
  PID:1020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-54-0x0000000000FC0000-0x0000000000FF2000-memory.dmp

Filesize
200KB

Download
memory/1808-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download