Overview

overview

10

Static

static

10

$RECYCLE.B...3D.exe

windows7-x64

$RECYCLE.B...3D.exe

windows10-2004-x64

$RECYCLE.B...L8H.js

windows7-x64

1

$RECYCLE.B...L8H.js

windows10-2004-x64

1

$RECYCLE.B...PRW.js

windows7-x64

1

$RECYCLE.B...PRW.js

windows10-2004-x64

1

$RECYCLE.B...R2U.js

windows7-x64

1

$RECYCLE.B...R2U.js

windows10-2004-x64

1

$RECYCLE.B...3D.exe

windows7-x64

10

$RECYCLE.B...3D.exe

windows10-2004-x64

10

$RECYCLE.B...L8H.js

windows7-x64

10

$RECYCLE.B...L8H.js

windows10-2004-x64

10

$RECYCLE.B...PRW.js

windows7-x64

10

$RECYCLE.B...PRW.js

windows10-2004-x64

10

$RECYCLE.B...R2U.js

windows7-x64

10

$RECYCLE.B...R2U.js

windows10-2004-x64

10

T817630494...Pdf.js

windows7-x64

10

T817630494...Pdf.js

windows10-2004-x64

10

Analysis

  • max time kernel
    92s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-02-2023 14:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $RECYCLE.BIN/$R40P23D.exe

  • Size

    92KB

  • MD5

    d40448b5ac56cf8f2a4bbea8d22982c2

  • SHA1

    ad405a4f3ea892a80b696f7460de70bbb6b082f8

  • SHA256

    d97bdbb4ad01f8873a141e7544160d070469b0c6865b823fec42184315b923cc

  • SHA512

    be9b6ffda6ebee70baa79bab24129150895bf5d06f0d634a1099e129bd63396c2f73e1c82115b6ca37df5aa5c406e3d1df2932e9a8dbeb927aacda727675082d

  • SSDEEP

    384:IiZHmh0O/Lrw+Ke8QEoDeJisnDPnFw5sglcMhQM0u+GrCPHFYgMSXA:IgGhHzr8e8B1PnFusmcDCXrCPqEXA

Score
10/10
purecrypterdownloaderloader

Malware Config

Extracted

Family

purecrypter

C2

https://ashaambulanceservice.com/Vuzbri.bmp

Signatures

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$R40P23D.exe
    "C:\Users\Admin\AppData\Local\Temp\$RECYCLE.BIN\$R40P23D.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2860
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 1984
      2⤵
      • Program crash
      PID:4836
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2860 -ip 2860
    1⤵
      PID:4024

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2860-133-0x0000000000330000-0x000000000034E000-memory.dmp
      Filesize

      120KB

      Download
    • memory/2860-134-0x00000000053A0000-0x0000000005944000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/2860-135-0x0000000004CF0000-0x0000000004D82000-memory.dmp
      Filesize

      584KB

      Download
    • memory/2860-136-0x0000000004F90000-0x0000000004FA0000-memory.dmp
      Filesize

      64KB

      Download