Analysis
-
max time kernel
120s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
24-10-2023 20:48
General
-
Target
NEAS.a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927exe_JC.exe
-
Size
24KB
-
MD5
163c5014971669c1f95a0bf3af51eb9e
-
SHA1
c5d5453240579f3ea5ffc7573558d1d4d8046d95
-
SHA256
a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927
-
SHA512
80c0e037b1ae81fa56f170dbb83d8f8e7cb362d57c937af3a5f56cc6bd04d836812e1734d3cee8746aa09f3f2eb54c89a5b196eb6e3941a2c68ddb9d7e3a8dcd
-
SSDEEP
384:+tnekGIJA9Sd2i22i22222A222sf122WO22u02u26x2u2B+222u2R222u2ek22u4:tSVWxSHoCKbEMfnTbxBl
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://cdn.discordapp.com/attachments/988727648014458883/988899741725257768/Gcosnd_Obqmhrws.bmp
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927exe_JC.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 17322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2988 -ip 29881⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB