Analysis
-
max time kernel
128s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06-03-2023 03:16
Static task
static1
Behavioral task
behavioral1
Sample
8f1997a2c103305f3141f6303e60009de3c19d950b365eb52ffca2ac157f5ffa.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8f1997a2c103305f3141f6303e60009de3c19d950b365eb52ffca2ac157f5ffa.exe
Resource
win10v2004-20230220-en
General
-
Target
8f1997a2c103305f3141f6303e60009de3c19d950b365eb52ffca2ac157f5ffa.exe
-
Size
7KB
-
MD5
446f190a9719e41662511df834b9a4d8
-
SHA1
daddeb4fa4630a56c7c0bd997f6bf22006db23c0
-
SHA256
8f1997a2c103305f3141f6303e60009de3c19d950b365eb52ffca2ac157f5ffa
-
SHA512
725e827013ebd2a1d123eb0eabee95de9ff7e316610412d281c14ab62ed6a98509d4edea6479db54b114d92f5ae40ad857122b2bc7eb6eceb083ae9a52fd7926
-
SSDEEP
96:nkTXVC82vh+WIjmKymmnahtGvMtOow0OQ+kInpDnbFnU:naXVCrNrCRCQj0d+
Malware Config
Signatures
-
Detect PureCrypter injector 34 IoCs
resource yara_rule behavioral1/memory/2020-56-0x0000000005AE0000-0x0000000005D62000-memory.dmp family_purecrypter behavioral1/memory/2020-57-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-58-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-60-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-62-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-64-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-66-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-72-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-70-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-68-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-78-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-76-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-74-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-80-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-86-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-84-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-82-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-120-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-118-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-116-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-114-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-112-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-110-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-108-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-106-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-104-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-102-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-100-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-98-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-96-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-94-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-92-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-90-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter behavioral1/memory/2020-88-0x0000000005AE0000-0x0000000005D5D000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2020 8f1997a2c103305f3141f6303e60009de3c19d950b365eb52ffca2ac157f5ffa.exe