Analysis
-
max time kernel
125s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
05-04-2023 11:03
General
-
Target
47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d.exe
-
Size
23KB
-
MD5
4a5b45207512b2f4ee3bd8cd7a25ba9e
-
SHA1
2700be565b25a627c86adf20798e90e99958a3ea
-
SHA256
47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d
-
SHA512
a1e26da024c534083fde7dee2846973489ceb06c536a751bde47fa74977efe5ab3762bd8f82bc427800eb43ee9e56064dcbd755d00454c2be112cdd04eb2e4ce
-
SSDEEP
384:YbrFmwPzQHzVZJq/S8frSo62tCT+UuSvwiFawG:Ah2HzIfrS8fiFa/
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://onedrive.live.com/download?cid=BD9480D014FE52E5&resid=BD9480D014FE52E5%21385&authkey=AB7WYGSbxFgcTyw
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d.exe"C:\Users\Admin\AppData\Local\Temp\47fb3f47c7d8d30d6bc605805e10fa9c60af5c0516b93e475c030da9144a715d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 19922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1132 -ip 11321⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
64KB