Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
23-07-2023 02:12
General
-
Target
Payment_Confirmation_230721pdf.exe
-
Size
53KB
-
MD5
4feef1aae6a0fec7806c2c0fbbee297e
-
SHA1
2be923d8dc05abe584621a4bff5c9178cf43777a
-
SHA256
e03f7cbee9ba8443d200f1bcc47101185dcdc27b965b0ce9b650a0aae4c40492
-
SHA512
44c8d14b4543909e5f1451f25330f8d7a9679d12b2eaefab2c21dd8cf1d41491d1e41b00230a4cf36b5be63ba1b9721ce8c4ee07d0f802b5c284c6c655661a31
-
SSDEEP
768:qgyiRquYaRH/+MSlKphRUsSnDK3EaC8l2bP3SScNY8nfRqTuM+1+S:q1iRTYqNuKZUsgDK3EaqL36G8ETugS
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://files.catbox.moe/730d8u.wav
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment_Confirmation_230721pdf.exe"C:\Users\Admin\AppData\Local\Temp\Payment_Confirmation_230721pdf.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 19402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 556 -ip 5561⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB