purecrypter | d7dd571b86ec131932b440a9599ce3d9b249bbf1af9f5e722631e5f7a842e925 | Triage

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2023 11:58

Sharing

Report Analysis Logs

General

Target

DaHost.exe
Size

43KB
MD5

7c93d0dd185ced28f3308d11090c7b6e
SHA1

a284043dda984e947e33c90a990168541de57c4d
SHA256

d7dd571b86ec131932b440a9599ce3d9b249bbf1af9f5e722631e5f7a842e925
SHA512

f7045c71acc444c4149b1a57e90d6a5454c1f33a55f5dd430ba7e72a3b5dc4ea95b58cdfda4a0551bb5296c29a72d65589ec07942a99ce9dba9ae3db4d093e5f
SSDEEP

768:dLJVNIWF8SfcccccccccccccccnOOOOOOOOOOOOOOuSrl57WNqE1U4O3CH:1JVNE7rl5CNtaaH

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

C2

http://192.210.215.42/v/panel/uploads/Dnlanfmltc.vdf

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6899B020-3B06-4BE4-8FE0-29E6084230F5}.catalogItem	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DaHost.exe

description pid process

Token: SeDebugPrivilege 1668 DaHost.exe

C:\Users\Admin\AppData\Local\Temp\DaHost.exe
"C:\Users\Admin\AppData\Local\Temp\DaHost.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:4060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-133-0x0000000000890000-0x00000000008A0000-memory.dmp

Filesize
64KB

Download
memory/1668-134-0x00000000052C0000-0x00000000052D0000-memory.dmp

Filesize
64KB

Download