purecrypter | 72230777bea3b7743dd098317f0761e2d609b345f96e5ff95e6ea13d3c14068a | Triage

Analysis

max time kernel
157s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2023 14:35

Sharing

Report Analysis Logs

General

Target

DHL DELIVERY INFORMATION_PDF.exe
Size

17KB
MD5

72d333e506d37d4669c41d8bbec9bc96
SHA1

0dc3ddf96b5ba5caec6b6643517fe68385abd150
SHA256

b7893446843d3e7293bc969fa52a2c7ecfe1bd1b83c5d9badaa0feb7d92be24f
SHA512

6914c75e240a4265b989740e69b283a0a4bbe357b07a1f6ade1b4757bce664e32c4d8e6e80b9075bbd3a2b8079727a2661383f74b0075b7ef28313f73170f7a1
SSDEEP

384:FMb8wRLeMj/CeKDQCkEKDVbJEp5KDGPGAC9:qbTa09mPGT

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

C2

https://onedrive.live.com/download?cid=BD9480D014FE52E5&resid=BD9480D014FE52E5%21386&authkey=AI3Byd9B8ZLvyCs

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DHL DELIVERY INFORMATION_PDF.exe

description pid process

Token: SeDebugPrivilege 2072 DHL DELIVERY INFORMATION_PDF.exe

C:\Users\Admin\AppData\Local\Temp\DHL DELIVERY INFORMATION_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL DELIVERY INFORMATION_PDF.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-133-0x00000000004F0000-0x00000000004FA000-memory.dmp

Filesize
40KB

Download
memory/2072-134-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/2072-135-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download