Analysis
-
max time kernel
76s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06-03-2023 21:42
Static task
static1
Behavioral task
behavioral1
Sample
cea7bb08e62531b48f8cdaac109e7669b78dd3d103e242f03bb3928b959e34b8.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cea7bb08e62531b48f8cdaac109e7669b78dd3d103e242f03bb3928b959e34b8.exe
Resource
win10v2004-20230221-en
General
-
Target
cea7bb08e62531b48f8cdaac109e7669b78dd3d103e242f03bb3928b959e34b8.exe
-
Size
7KB
-
MD5
3948c7c9a7047bea770c6452b6c3443e
-
SHA1
6cf36937cfe8e8dd4434d28265a2934f0a1a549a
-
SHA256
cea7bb08e62531b48f8cdaac109e7669b78dd3d103e242f03bb3928b959e34b8
-
SHA512
921a5f47596b12659568f140921973702c8153125b1db58501b487afbf4468c7b37767ff2b2a326014ef09a75ca1e1e18b3efeb67dcfd8ce8babf88dffcd82fd
-
SSDEEP
96:rbHw8nbqJsnrEvj1TZY7ZMtUzzu+kGEVOWxzNt:rk8uJ+EvxkzzujGEAWT
Malware Config
Signatures
-
Detect PureCrypter injector 34 IoCs
resource yara_rule behavioral1/memory/2000-56-0x0000000005CF0000-0x0000000005F54000-memory.dmp family_purecrypter behavioral1/memory/2000-57-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-58-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-60-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-62-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-64-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-66-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-68-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-70-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-72-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-74-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-76-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-78-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-80-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-82-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-84-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-86-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-88-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-90-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-92-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-94-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-96-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-98-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-100-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-102-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-104-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-106-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-108-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-110-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-112-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-114-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-116-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-118-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter behavioral1/memory/2000-120-0x0000000005CF0000-0x0000000005F4E000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2000 cea7bb08e62531b48f8cdaac109e7669b78dd3d103e242f03bb3928b959e34b8.exe