purecrypter | ec7ca241abdc7b12dd870aee6feb00f0d5faaf714074246c39c7891f1c8d7149 | Triage

Analysis

max time kernel
119s
max time network
109s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-02-2023 16:06

Sharing

Report Analysis Logs

General

Target

file.exe
Size

194KB
MD5

8219cf79a105ecdd2250dc76cd091423
SHA1

ff10eaeabe81cc08b3040cd88474237ceff79626
SHA256

ec7ca241abdc7b12dd870aee6feb00f0d5faaf714074246c39c7891f1c8d7149
SHA512

e4f62a2c4e34538b8f64f3de333792c343fdfd10a2020845f77b0786f910811b5888e525b9ad03e7764b9d07f9e3a28aae59d521280d8911b56e59a42b8080b1
SSDEEP

1536:WuI0RP3VoraIlrxCka52oXKsuWoZLO6zaTlz5vF:WutRvVsVK2OKsuWoZLnaz

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

C2

http://rssh.li/panel/uploads/Cybfubub.dat

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	1504	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	file.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1740	1504	file.exe	28
PID 1504 wrote to memory of 1740	1504	file.exe	28
PID 1504 wrote to memory of 1740	1504	file.exe	28
PID 1504 wrote to memory of 1740	1504	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 1312
  2⤵
  - Program crash
  PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-54-0x0000000000E80000-0x0000000000EB2000-memory.dmp

Filesize
200KB

Download
memory/1504-55-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download