purecrypter | 6117bcb631fe98190f2a23cb1854690eba95e9b33d1cdaba222e9f8b17665319 | Triage

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25-02-2023 02:25

Sharing

Report Analysis Logs

General

Target

aee15cf59502cb15f986c6dd67e106a5.exe
Size

25KB
MD5

aee15cf59502cb15f986c6dd67e106a5
SHA1

4d8e5d97a8cfe4f6589f3a9adb3fb0d2e922a6a9
SHA256

6117bcb631fe98190f2a23cb1854690eba95e9b33d1cdaba222e9f8b17665319
SHA512

c518192264a2fcb55ce34f21ad5bae0967167726576c781181c26d03e34b002e38c25c861e4a1f67205c379b568c008fa5d00b4a0b44368e27e780286eb4da44
SSDEEP

192:MFhy2qHCEpwE/EPkLWYX+fTdRyLW/Nt8L3GqAa:ohy2qHDtqkLWw+fTbyStGA

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

C2

http://argentum.com.br/well-known/acme-challenge/k/h/d/g/Pnhez.bmp

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	aee15cf59502cb15f986c6dd67e106a5.exe

C:\Users\Admin\AppData\Local\Temp\aee15cf59502cb15f986c6dd67e106a5.exe
"C:\Users\Admin\AppData\Local\Temp\aee15cf59502cb15f986c6dd67e106a5.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-54-0x0000000000DD0000-0x0000000000DDC000-memory.dmp

Filesize
48KB

Download
memory/1992-55-0x0000000000600000-0x0000000000640000-memory.dmp

Filesize
256KB

Download
memory/1992-56-0x0000000000600000-0x0000000000640000-memory.dmp

Filesize
256KB

Download