Analysis
-
max time kernel
96s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
25-02-2023 01:44
General
-
Target
d97bdbb4ad01f8873a141e7544160d070469b0c6865b823fec42184315b923cc.exe
-
Size
92KB
-
MD5
d40448b5ac56cf8f2a4bbea8d22982c2
-
SHA1
ad405a4f3ea892a80b696f7460de70bbb6b082f8
-
SHA256
d97bdbb4ad01f8873a141e7544160d070469b0c6865b823fec42184315b923cc
-
SHA512
be9b6ffda6ebee70baa79bab24129150895bf5d06f0d634a1099e129bd63396c2f73e1c82115b6ca37df5aa5c406e3d1df2932e9a8dbeb927aacda727675082d
-
SSDEEP
384:IiZHmh0O/Lrw+Ke8QEoDeJisnDPnFw5sglcMhQM0u+GrCPHFYgMSXA:IgGhHzr8e8B1PnFusmcDCXrCPqEXA
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://ashaambulanceservice.com/Vuzbri.bmp
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d97bdbb4ad01f8873a141e7544160d070469b0c6865b823fec42184315b923cc.exe"C:\Users\Admin\AppData\Local\Temp\d97bdbb4ad01f8873a141e7544160d070469b0c6865b823fec42184315b923cc.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 20002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3820 -ip 38201⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
64KB