purecrypter | d7dd571b86ec131932b440a9599ce3d9b249bbf1af9f5e722631e5f7a842e925 | Triage

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30-06-2023 11:58

Sharing

Report Analysis Logs

General

Target

DaHost.exe
Size

43KB
MD5

7c93d0dd185ced28f3308d11090c7b6e
SHA1

a284043dda984e947e33c90a990168541de57c4d
SHA256

d7dd571b86ec131932b440a9599ce3d9b249bbf1af9f5e722631e5f7a842e925
SHA512

f7045c71acc444c4149b1a57e90d6a5454c1f33a55f5dd430ba7e72a3b5dc4ea95b58cdfda4a0551bb5296c29a72d65589ec07942a99ce9dba9ae3db4d093e5f
SSDEEP

768:dLJVNIWF8SfcccccccccccccccnOOOOOOOOOOOOOOuSrl57WNqE1U4O3CH:1JVNE7rl5CNtaaH

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

C2

http://192.210.215.42/v/panel/uploads/Dnlanfmltc.vdf

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DaHost.exe

description pid process

Token: SeDebugPrivilege 1428 DaHost.exe

C:\Users\Admin\AppData\Local\Temp\DaHost.exe
"C:\Users\Admin\AppData\Local\Temp\DaHost.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-54-0x0000000000B40000-0x0000000000B50000-memory.dmp

Filesize
64KB

Download
memory/1428-55-0x0000000004C50000-0x0000000004C90000-memory.dmp

Filesize
256KB

Download