Analysis
-
max time kernel
54s -
max time network
74s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
22-02-2023 11:41
General
-
Target
gconok.gq_-_trashh_-_fgbt.exe___8c1f5bb7aeb14d011c37f7a8df464be7.exe
-
Size
21KB
-
MD5
8c1f5bb7aeb14d011c37f7a8df464be7
-
SHA1
6f9242255bb37060649aaf2bce99695296873a18
-
SHA256
7856d1ddcd00cae05c8a054b5690ec1a3286b71bd6dbf7e54e18f85b090e2c36
-
SHA512
3a7a4a6341d286767c493a3cd958f84b6c3ff1431ca797c7abeb8dca380128754c83e22a37485ec66d2755a8d7f63c7523c16baf550b3fb6acf0f67f17499fac
-
SSDEEP
384:oldLLlGvGpYAVLK624DJd/SidRssDFmE/:aBLlxpY4LK6JZSidGsxmE/
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://gconok.gq/trashh/Yagxvv.dat
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\gconok.gq_-_trashh_-_fgbt.exe___8c1f5bb7aeb14d011c37f7a8df464be7.exe"C:\Users\Admin\AppData\Local\Temp\gconok.gq_-_trashh_-_fgbt.exe___8c1f5bb7aeb14d011c37f7a8df464be7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 19882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5104 -ip 51041⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
-
Filesize
64KB