purecrypter | 4b3369d4573807efe4bf8f571472ee2093e0b28c17eef94d73ba1ed63cf959aa

General

Target

TORRENTOLD-1.exe
Size

1.3MB
MD5

984f8dd35c2ae61a310992832df6cedf
SHA1

2262fb9d4244a33d359140fdfd6d89779a887b41
SHA256

4b3369d4573807efe4bf8f571472ee2093e0b28c17eef94d73ba1ed63cf959aa
SHA512

509b94ffaee394f1c2d7e79a21cb966068a42cc5a774c765a2bd86b1f55982810840e61262581cbed879e8ec85f39fee7823467d1d81ee6a07599e709c5d6792
SSDEEP

24576:b2LBa1xIo0t29o0wu7osrgS4UTOHwnsXIScCfhJfmHCSjg:bk+xb049odAFksTLnsXz7mHj

Score

10^/10

purecrypter redline zgrat torrentold downloader infostealer loader rat

Malware Config

Extracted

Family

redline

Botnet

TORRENTOLD

C2

amrican-sport-live-stream.cc:4581

Attributes

auth_value
74e1b58bf920611f04c0e3919954fe05

Signatures

Detect PureCrypter injector 34 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/2208-3-0x0000000004F10000-0x0000000005194000-memory.dmp	family_purecrypter
behavioral1/memory/2208-5-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-4-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-7-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-9-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-11-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-13-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-15-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-17-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-19-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-21-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-23-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-25-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-27-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-29-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-31-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-33-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-35-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-37-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-39-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-41-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-43-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-45-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-47-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-49-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-51-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-53-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-55-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-57-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-59-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-61-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-63-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-65-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-67-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2208-3-0x0000000004F10000-0x0000000005194000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-5-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-4-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-7-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-9-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-11-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-13-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-15-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-17-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-19-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-21-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-23-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-25-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-27-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-29-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-31-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-33-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-35-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-37-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-39-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-41-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-43-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-45-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-47-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-49-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-51-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-53-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-55-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-57-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-59-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-61-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-63-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-65-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-67-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Suspicious use of SetThreadContext 1 IoCs

Processes:

TORRENTOLD-1.exe

description pid process target process

PID 2208 set thread context of 1548 2208 TORRENTOLD-1.exe InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

TORRENTOLD-1.exe

description pid process

Token: SeDebugPrivilege 2208 TORRENTOLD-1.exe

description	pid	process	target process
PID 2208 set thread context of 1548	2208	TORRENTOLD-1.exe	InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	2208	TORRENTOLD-1.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

TORRENTOLD-1.exe

description	pid	process	target process
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	InstallUtil.exe
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	InstallUtil.exe
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	InstallUtil.exe
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	InstallUtil.exe
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	InstallUtil.exe
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	InstallUtil.exe
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	InstallUtil.exe
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	InstallUtil.exe
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	InstallUtil.exe
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	InstallUtil.exe
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	InstallUtil.exe
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\TORRENTOLD-1.exe
"C:\Users\Admin\AppData\Local\Temp\TORRENTOLD-1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
2⤵
PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-10180-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1548-10185-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/1548-10184-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1548-10183-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/1548-10182-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-39-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-47-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-9-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-11-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-13-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-15-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-17-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-19-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-21-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-23-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-25-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-27-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-29-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-31-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-33-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-35-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-37-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-0-0x0000000001220000-0x000000000136C000-memory.dmp

Filesize
1.3MB

Download
memory/2208-41-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-43-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-45-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-7-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-49-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-51-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-53-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-55-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-57-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-59-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-61-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-63-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-65-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-67-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-2492-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-2847-0x0000000004ED0000-0x0000000004F10000-memory.dmp

Filesize
256KB

Download
memory/2208-10166-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Filesize
384KB

Download
memory/2208-4-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-10181-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-5-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-3-0x0000000004F10000-0x0000000005194000-memory.dmp

Filesize
2.5MB

Download
memory/2208-2-0x0000000004ED0000-0x0000000004F10000-memory.dmp

Filesize
256KB

Download
memory/2208-1-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads