Analysis
- max time kernel
96s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
25/02/2023, 01:44
General
- Target d97bdbb4ad01f8873a141e7544160d070469b0c6865b823fec42184315b923cc.exe
- Size 92KB
- Sample230225-b5tg3sbf98
- SHA256 d97bdbb4ad01f8873a141e7544160d070469b0c6865b823fec42184315b923cc
Score
10/10
Malware Config
Extracted
Family
-
purecrypter
C2
-
https://ashaambulanceservice.com/Vuzbri.bmp
Signatures
- PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d97bdbb4ad01f8873a141e7544160d070469b0c6865b823fec42184315b923cc.exe"C:\Users\Admin\AppData\Local\Temp\d97bdbb4ad01f8873a141e7544160d070469b0c6865b823fec42184315b923cc.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 20002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3820 -ip 38201⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3820-133-0x0000000000030000-0x000000000004E000-memory.dmp
memory/3820-134-0x0000000005030000-0x00000000055D4000-memory.dmp
memory/3820-135-0x0000000004A80000-0x0000000004B12000-memory.dmp
memory/3820-136-0x00000000049F0000-0x0000000004A00000-memory.dmp