purecrypter | 9778c6d49c3ab49c7fd8c4bbbffd5e16aeca9ee0074a9c0854a55adde768e03e | Triage

Analysis

max time kernel
116s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2023, 16:06

Sharing

Report Analysis Logs

General

Target

file.exe
Size

195KB
MD5

b9242c8c1b0d0beb00c9d67a20e85c73
SHA1

43592d357c784c64b4182f7d04f293738ea8e848
SHA256

9778c6d49c3ab49c7fd8c4bbbffd5e16aeca9ee0074a9c0854a55adde768e03e
SHA512

e627268ac515cfeadcb44d6bd39c636855d94d523e31362be414b0245cb45cf2def518cadb656db894d54af50d95bd5e73b68f87c34fcbf9dd2c9b033a8d9693
SSDEEP

1536:fLMoVToraIlrxCka52oXKsuWoZxX6zaTlz5vF:fLMoFsVK2OKsuWoZxqaz

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

C2

http://rssh.li/panel/uploads/Sutpvfujdol.bmp

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4476	4460	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1712
  2⤵
  - Program crash
  PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4460 -ip 4460
1⤵
PID:5020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4460-132-0x00000000003A0000-0x00000000003D2000-memory.dmp

Filesize
200KB

Download
memory/4460-133-0x0000000005400000-0x00000000059A4000-memory.dmp

Filesize
5.6MB

Download
memory/4460-134-0x0000000004D70000-0x0000000004E02000-memory.dmp

Filesize
584KB

Download