purecrypter | a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56

General

Target

a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe
Size

86KB
MD5

032a3d2901dc768d4278f77e374c612e
SHA1

418ddb4482611b4e8da94c6b670a98b1c8c2d6fb
SHA256

a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56
SHA512

d867657ff514ec2aeea0454df8be7ef5d8561c0f29e0101bf721a9ab220e2a5ede60b02608e403afdc5efa9eeca96ef7f3a6b60640dd6594adcea3b12a849b51
SSDEEP

1536:lnVZxHC4Fo9jGPoCGVjGWmt8CXZ+63x+w4JD+0NL+fKX:9Jr+GPo9St8WHxSD+09+SX

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

C2

http://puresvr01.sytes.net/dashboard/panel/uploads/Afxufottv.bmp

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Suspicious use of SetThreadContext 1 IoCs

Processes:

a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe

description	pid	process	target process
PID 1080 set thread context of 1484	1080	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exea3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe

description	pid	process
Token: SeDebugPrivilege	1080	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe
Token: SeDebugPrivilege	1484	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe

description	pid	process	target process
PID 1080 wrote to memory of 1484	1080	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe
PID 1080 wrote to memory of 1484	1080	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe
PID 1080 wrote to memory of 1484	1080	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe
PID 1080 wrote to memory of 1484	1080	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe
PID 1080 wrote to memory of 1484	1080	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe
PID 1080 wrote to memory of 1484	1080	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe
PID 1080 wrote to memory of 1484	1080	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe
PID 1080 wrote to memory of 1484	1080	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe	a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe

C:\Users\Admin\AppData\Local\Temp\a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe
"C:\Users\Admin\AppData\Local\Temp\a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080

C:\Users\Admin\AppData\Local\Temp\a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe
C:\Users\Admin\AppData\Local\Temp\a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\a3cf0ee3245538f461f0efa1b292a666d9e0f4283171abc265a645788193da56.exe.log
Filesize
1KB

MD5
3a9188331a78f1dbce606db64b841fcb

SHA1
8e2c99b7c477d06591a856a4ea3e1e214719eee8

SHA256
db4137e258a0f6159fda559a5f6dd2704be0582c3f0586f65040c7ad1eb68451

SHA512
d1a994610a045d89d5d306866c24ae56bf16555414b8f63f632552568e67b5586f26d5a17a1f0a55ada376730298e6d856e9161828d4eae9decfa4e015e0e90a

Download Submit
memory/1080-133-0x0000000000ED0000-0x0000000000EEC000-memory.dmp

Filesize
112KB

Download
memory/1080-134-0x0000000005990000-0x00000000059A0000-memory.dmp

Filesize
64KB

Download
memory/1080-135-0x0000000005990000-0x00000000059A0000-memory.dmp

Filesize
64KB

Download
memory/1080-136-0x0000000006C50000-0x0000000006C72000-memory.dmp

Filesize
136KB

Download
memory/1484-167-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-171-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-142-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-144-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-146-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-148-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-149-0x0000000005490000-0x00000000054A0000-memory.dmp

Filesize
64KB

Download
memory/1484-151-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-153-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-155-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-157-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-159-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-161-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-163-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-165-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-139-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-169-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-140-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-173-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-175-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-177-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-179-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-181-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-183-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-185-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-187-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-189-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-191-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-193-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-195-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-197-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-199-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-201-0x0000000005500000-0x0000000005572000-memory.dmp

Filesize
456KB

Download
memory/1484-137-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1484-1953-0x0000000005490000-0x00000000054A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads