Analysis
-
max time kernel
142s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
18-05-2023 02:01
General
-
Target
DHL DELIVERY INFORMATION_PDF.exe
-
Size
17KB
-
MD5
72d333e506d37d4669c41d8bbec9bc96
-
SHA1
0dc3ddf96b5ba5caec6b6643517fe68385abd150
-
SHA256
b7893446843d3e7293bc969fa52a2c7ecfe1bd1b83c5d9badaa0feb7d92be24f
-
SHA512
6914c75e240a4265b989740e69b283a0a4bbe357b07a1f6ade1b4757bce664e32c4d8e6e80b9075bbd3a2b8079727a2661383f74b0075b7ef28313f73170f7a1
-
SSDEEP
384:FMb8wRLeMj/CeKDQCkEKDVbJEp5KDGPGAC9:qbTa09mPGT
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://onedrive.live.com/download?cid=BD9480D014FE52E5&resid=BD9480D014FE52E5%21386&authkey=AI3Byd9B8ZLvyCs
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL DELIVERY INFORMATION_PDF.exe"C:\Users\Admin\AppData\Local\Temp\DHL DELIVERY INFORMATION_PDF.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 19642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 632 -ip 6321⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB