Analysis
-
max time kernel
62s -
max time network
58s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
17/03/2023, 12:55
General
-
Target
Qhxujqkxtf.exe
-
Size
6KB
-
MD5
4fc2df99dcdbf2886d139b0f4dfad85c
-
SHA1
5c02c737e12540a6b5c56615b9b972ee171d2aa1
-
SHA256
c7cbb1b4915f9cbce71dbe9df6027e73166fef1fce95976685640845e5f79685
-
SHA512
ae83119c6d47b6f6f06ab372cb584d88f01560c9847451faf00b61aa93373f492613b36dee83ae51ed2268ac9b553f70ec46522583d9636a91114f760abe14e5
-
SSDEEP
96:DgdesBVLuiDTgIlNtuL/A3/I63yPRZjXMRWV6xjtLEk9sl8jzNt:EYsd/jtuLIg6YT4Rd5t9y8l
Malware Config
Extracted
purecrypter
https://wemodd.co/Anrwqjqr.dll
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Qhxujqkxtf.exe"C:\Users\Admin\AppData\Local\Temp\Qhxujqkxtf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Jbdjkkwmltuvghizyaiqunhjpihsm.exe"C:\Users\Admin\AppData\Local\Temp\Jbdjkkwmltuvghizyaiqunhjpihsm.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 5; Stop-Process 1268 -Force; Start-Sleep -Seconds 2; Remove-Item "C:\Users\Admin\AppData\Local\Temp\Qhxujqkxtf.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
292KB
MD565727c071543cc129d7476b1c4b15b6f
SHA1d8aba3f3ccb07ff5712bcac50df2bf7a9b2e6bf5
SHA256737db69684061395728f0145604c7110297605bc143c68dc599a2e96e264553c
SHA5120eba2062df4b6f25a41ca14e4e2360ec5319c639620a08943263ebd2c707fd2fb6c6b64674b897e6ba4bfa439773ca4d6a25d20d27cc0d9abd086f5704bdb5ca
-
Filesize
292KB
MD565727c071543cc129d7476b1c4b15b6f
SHA1d8aba3f3ccb07ff5712bcac50df2bf7a9b2e6bf5
SHA256737db69684061395728f0145604c7110297605bc143c68dc599a2e96e264553c
SHA5120eba2062df4b6f25a41ca14e4e2360ec5319c639620a08943263ebd2c707fd2fb6c6b64674b897e6ba4bfa439773ca4d6a25d20d27cc0d9abd086f5704bdb5ca
-
Filesize
7KB
MD5dc3159f8782a3a98897a43b77e5dcad5
SHA1a0570216984674c940c2eb43ffdc3d13ca90cf68
SHA256adae57044ab86d58dd0edea4a3afae46fda7855699146c1365c4ceffe23fa53c
SHA51231824cf385f4acccf7211592694f0b13764c44d3ce2f2dbaddd227c209ba11b1b5a28a95090d6f36c9bcccac1258d3b22aaa7ad51ac011d72f01f97eb687ee8b
-
Filesize
7KB
MD5dc3159f8782a3a98897a43b77e5dcad5
SHA1a0570216984674c940c2eb43ffdc3d13ca90cf68
SHA256adae57044ab86d58dd0edea4a3afae46fda7855699146c1365c4ceffe23fa53c
SHA51231824cf385f4acccf7211592694f0b13764c44d3ce2f2dbaddd227c209ba11b1b5a28a95090d6f36c9bcccac1258d3b22aaa7ad51ac011d72f01f97eb687ee8b
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
512KB
-
Filesize
4KB
-
Filesize
588KB
-
Filesize
568KB
-
Filesize
220KB
-
Filesize
640KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
624KB
-
Filesize
1.3MB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
728KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
24KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
624KB
-
Filesize
344KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
304KB
-
Filesize
336KB
-
Filesize
256KB
-
Filesize
24KB
-
Filesize
320KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB