Overview

overview

10

Static

static

10

POdocsx.exe

windows7-x64

10

POdocsx.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    104s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-04-2023 00:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    POdocsx.exe

  • Size

    6KB

  • MD5

    453b9d2e21ab4965444c1266fca02cf2

  • SHA1

    16ee3b13e98daa37d69b22ca4b4979fd46a22f11

  • SHA256

    ed1cc576fdd8b85cbef3cf6c587bd23991bf6427d6de38c82bbff8b4419e39bf

  • SHA512

    7fe690048bb763315d977805ccd083516b29f09b20df14a50ba8fec5fad20ddce1d89ecf59ce0d9a935d42de943066371ba18da280e2f58b2fcfc0ef54449170

  • SSDEEP

    96:+B7LfLooht25dmeU/R1QFBQdU6Ro0eSb/Ik9zNt:+BH2rZU/MFBwUyodGj3

Score
10/10
purecrypterdownloaderloader

Malware Config

Extracted

Family

purecrypter

C2

https://dweb.link/ipfs/QmVTrwuknBf6QyeA2UHcHCzRr3r1qs8ppnU6hnun5FypKR?filename=Iokleog_Jkccwzyt.jpg

Signatures

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\POdocsx.exe
    "C:\Users\Admin\AppData\Local\Temp\POdocsx.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1304-133-0x00000000000C0000-0x00000000000C8000-memory.dmp
    Filesize

    32KB

    Download
  • memory/1304-134-0x0000000004B10000-0x0000000004B20000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1304-135-0x0000000004B10000-0x0000000004B20000-memory.dmp
    Filesize

    64KB

    Download