Analysis
-
max time kernel
151s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-03-2023 03:16
Static task
static1
Behavioral task
behavioral1
Sample
8f1997a2c103305f3141f6303e60009de3c19d950b365eb52ffca2ac157f5ffa.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8f1997a2c103305f3141f6303e60009de3c19d950b365eb52ffca2ac157f5ffa.exe
Resource
win10v2004-20230220-en
General
-
Target
8f1997a2c103305f3141f6303e60009de3c19d950b365eb52ffca2ac157f5ffa.exe
-
Size
7KB
-
MD5
446f190a9719e41662511df834b9a4d8
-
SHA1
daddeb4fa4630a56c7c0bd997f6bf22006db23c0
-
SHA256
8f1997a2c103305f3141f6303e60009de3c19d950b365eb52ffca2ac157f5ffa
-
SHA512
725e827013ebd2a1d123eb0eabee95de9ff7e316610412d281c14ab62ed6a98509d4edea6479db54b114d92f5ae40ad857122b2bc7eb6eceb083ae9a52fd7926
-
SSDEEP
96:nkTXVC82vh+WIjmKymmnahtGvMtOow0OQ+kInpDnbFnU:naXVCrNrCRCQj0d+
Malware Config
Signatures
-
Detect PureCrypter injector 33 IoCs
resource yara_rule behavioral2/memory/2584-135-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-136-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-138-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-140-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-142-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-144-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-146-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-148-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-150-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-152-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-154-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-156-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-158-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-160-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-162-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-164-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-166-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-168-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-170-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-172-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-174-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-176-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-178-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-180-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-182-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-184-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-186-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-188-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-190-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-192-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-194-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-196-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter behavioral2/memory/2584-198-0x0000000005EA0000-0x000000000611D000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2584 8f1997a2c103305f3141f6303e60009de3c19d950b365eb52ffca2ac157f5ffa.exe