Analysis
-
max time kernel
151s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2023 11:02
Static task
static1
Behavioral task
behavioral1
Sample
3944a1d4b4fdf0b1a5aecaa579a3c9acac4536544b440acc8362d456f46d3cb4.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3944a1d4b4fdf0b1a5aecaa579a3c9acac4536544b440acc8362d456f46d3cb4.exe
Resource
win10v2004-20230220-en
General
-
Target
3944a1d4b4fdf0b1a5aecaa579a3c9acac4536544b440acc8362d456f46d3cb4.exe
-
Size
2.4MB
-
MD5
8f04f8e4f87a7e19053f745b6fbcb795
-
SHA1
5207f1704c26b19ab175882ab03a13aa42f88f48
-
SHA256
3944a1d4b4fdf0b1a5aecaa579a3c9acac4536544b440acc8362d456f46d3cb4
-
SHA512
89d372996ecf01293d69267b4c151e59a4dca3968c9f28d5795d620a45232b2ccd3aa29aa87eb540c44d06541d90dbfd5c020c77a0d850e5a4f0eee063a9fe5a
-
SSDEEP
49152:Lp7dJRVGJ0vXg055FGLXBFC/tU6aqws96MayXjq7262LMJfS4h1Y:Lp7dJR0+vXg055FSXBFC1gq9kM3zm0MG
Malware Config
Signatures
-
Detect PureCrypter injector 33 IoCs
resource yara_rule behavioral2/memory/5084-134-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-135-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-137-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-139-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-141-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-143-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-145-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-147-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-149-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-151-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-153-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-155-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-157-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-159-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-161-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-163-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-165-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-167-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-169-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-171-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-173-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-175-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-177-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-179-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-181-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-183-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-185-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-187-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-189-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-191-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-193-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-195-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter behavioral2/memory/5084-197-0x0000000005A70000-0x0000000005CD2000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5084 3944a1d4b4fdf0b1a5aecaa579a3c9acac4536544b440acc8362d456f46d3cb4.exe