Analysis
- max time kernel
140s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20230221-en - resource tags
- submitted
28/02/2023, 01:09
General
- Target ef0fdc710efe73584e0e6a0a16840fb3863ac5c27d73148463242f53b003991c.exe
- Size 7KB
- Sample230228-bh331agg78
- SHA256 ef0fdc710efe73584e0e6a0a16840fb3863ac5c27d73148463242f53b003991c
Score
10/10
Malware Config
Extracted
Family
-
purecrypter
C2
-
https://cents-ability.org/loader/uploads/noicon_Pzogzejv.png
Signatures
- PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef0fdc710efe73584e0e6a0a16840fb3863ac5c27d73148463242f53b003991c.exe"C:\Users\Admin\AppData\Local\Temp\ef0fdc710efe73584e0e6a0a16840fb3863ac5c27d73148463242f53b003991c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4980-133-0x00000000000B0000-0x00000000000B8000-memory.dmp
memory/4980-134-0x0000000004A00000-0x0000000004A66000-memory.dmp
memory/4980-135-0x0000000004FA0000-0x0000000004FB0000-memory.dmp
memory/4980-136-0x0000000004FA0000-0x0000000004FB0000-memory.dmp