purecrypter | 7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2023 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e.exe
Size

1.2MB
MD5

b27e75867100b7f34b35cf147b7ce92e
SHA1

e1b51e321d8a5595cc0382198a6ab34c98924194
SHA256

7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e
SHA512

b71ba509772548d94d7a31685527f454ffc12380fa1537ef133140ece9f67d9070d21497b5694adbe405c528bb83266409053f754a437cde9caf361797318773
SSDEEP

24576:H1qOg/vTimfbpDY0aV9+rOL54vwe7r9MCdoavl30Og:zgHGmfbp+V9fqvwe7r9MOl

Score

10^/10

purecrypter redline tpb downloader infostealer loader

Malware Config

Extracted

Family

redline

Botnet

TPB

amrican-sport-live-stream.cc:4581

Attributes

auth_value
9af3f668d2aa93965a3f83753e8ccb3f

Signatures

Detect PureCrypter injector 33 IoCs

loader

resource	yara_rule
behavioral1/memory/2268-135-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-136-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-138-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-140-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-142-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-144-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-146-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-148-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-150-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-152-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-154-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-156-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-158-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-160-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-162-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-164-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-166-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-168-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-170-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-172-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-174-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-176-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-178-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-180-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-182-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-184-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-186-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-188-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-190-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-192-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-194-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-196-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter
behavioral1/memory/2268-198-0x0000000004F60000-0x00000000051C9000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2268 set thread context of 2272	2268	7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2272	2268	7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e.exe	85
PID 2268 wrote to memory of 2272	2268	7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e.exe	85
PID 2268 wrote to memory of 2272	2268	7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e.exe	85
PID 2268 wrote to memory of 2272	2268	7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e.exe	85
PID 2268 wrote to memory of 2272	2268	7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e.exe	85
PID 2268 wrote to memory of 2272	2268	7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e.exe	85
PID 2268 wrote to memory of 2272	2268	7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e.exe	85
PID 2268 wrote to memory of 2272	2268	7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e.exe	85

C:\Users\Admin\AppData\Local\Temp\7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e.exe
"C:\Users\Admin\AppData\Local\Temp\7304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  PID:2272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-133-0x0000000000550000-0x0000000000692000-memory.dmp

Filesize
1.3MB

Download
memory/2268-134-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/2268-135-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-136-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-138-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-140-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-142-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-144-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-146-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-148-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-150-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-152-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-154-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-156-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-158-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-160-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-162-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-164-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-166-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-168-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-170-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-172-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-174-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-176-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-178-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-180-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-182-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-184-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-186-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-188-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-190-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-192-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-194-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-196-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-198-0x0000000004F60000-0x00000000051C9000-memory.dmp

Filesize
2.4MB

Download
memory/2268-705-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/2268-10220-0x0000000000DD0000-0x0000000000DF2000-memory.dmp

Filesize
136KB

Download
memory/2268-10221-0x00000000054C0000-0x0000000005526000-memory.dmp

Filesize
408KB

Download
memory/2268-10222-0x000000003A8E0000-0x000000003A972000-memory.dmp

Filesize
584KB

Download
memory/2268-10223-0x000000003AF30000-0x000000003B4D4000-memory.dmp

Filesize
5.6MB

Download
memory/2272-10226-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2272-10227-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/2272-10228-0x000000000B040000-0x000000000B658000-memory.dmp

Filesize
6.1MB

Download
memory/2272-10229-0x000000000AB80000-0x000000000AC8A000-memory.dmp

Filesize
1.0MB

Download
memory/2272-10230-0x000000000AAB0000-0x000000000AAC2000-memory.dmp

Filesize
72KB

Download
memory/2272-10231-0x000000000AB10000-0x000000000AB4C000-memory.dmp

Filesize
240KB

Download
memory/2272-10232-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download