purecrypter | 4b3369d4573807efe4bf8f571472ee2093e0b28c17eef94d73ba1ed63cf959aa

Analysis

max time kernel
203s
max time network
213s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
08-11-2023 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TORRENTOLD-1.exe
Size

1.3MB
MD5

984f8dd35c2ae61a310992832df6cedf
SHA1

2262fb9d4244a33d359140fdfd6d89779a887b41
SHA256

4b3369d4573807efe4bf8f571472ee2093e0b28c17eef94d73ba1ed63cf959aa
SHA512

509b94ffaee394f1c2d7e79a21cb966068a42cc5a774c765a2bd86b1f55982810840e61262581cbed879e8ec85f39fee7823467d1d81ee6a07599e709c5d6792
SSDEEP

24576:b2LBa1xIo0t29o0wu7osrgS4UTOHwnsXIScCfhJfmHCSjg:bk+xb049odAFksTLnsXz7mHj

Score

10^/10

purecrypter redline zgrat torrentold downloader infostealer loader rat

Malware Config

Extracted

Family

redline

Botnet

TORRENTOLD

amrican-sport-live-stream.cc:4581

Attributes

auth_value
74e1b58bf920611f04c0e3919954fe05

Signatures

Detect PureCrypter injector 34 IoCs

loader

resource	yara_rule
behavioral1/memory/2208-3-0x0000000004F10000-0x0000000005194000-memory.dmp	family_purecrypter
behavioral1/memory/2208-5-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-4-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-7-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-9-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-11-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-13-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-15-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-17-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-19-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-21-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-23-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-25-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-27-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-29-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-31-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-33-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-35-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-37-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-39-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-41-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-43-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-45-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-47-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-49-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-51-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-53-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-55-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-57-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-59-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-61-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-63-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-65-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter
behavioral1/memory/2208-67-0x0000000004F10000-0x000000000518F000-memory.dmp	family_purecrypter

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/2208-3-0x0000000004F10000-0x0000000005194000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-5-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-4-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-7-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-9-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-11-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-13-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-15-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-17-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-19-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-21-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-23-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-25-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-27-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-29-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-31-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-33-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-35-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-37-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-39-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-41-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-43-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-45-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-47-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-49-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-51-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-53-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-55-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-57-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-59-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-61-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-63-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-65-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1
behavioral1/memory/2208-67-0x0000000004F10000-0x000000000518F000-memory.dmp	family_zgrat_v1

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2208 set thread context of 1548	2208	TORRENTOLD-1.exe	31

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	TORRENTOLD-1.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	31
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	31
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	31
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	31
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	31
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	31
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	31
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	31
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	31
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	31
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	31
PID 2208 wrote to memory of 1548	2208	TORRENTOLD-1.exe	31

C:\Users\Admin\AppData\Local\Temp\TORRENTOLD-1.exe
"C:\Users\Admin\AppData\Local\Temp\TORRENTOLD-1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-10180-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1548-10185-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/1548-10184-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/1548-10183-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/1548-10182-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-39-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-47-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-9-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-11-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-13-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-15-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-17-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-19-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-21-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-23-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-25-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-27-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-29-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-31-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-33-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-35-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-37-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-0-0x0000000001220000-0x000000000136C000-memory.dmp

Filesize
1.3MB

Download
memory/2208-41-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-43-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-45-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-7-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-49-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-51-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-53-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-55-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-57-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-59-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-61-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-63-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-65-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-67-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-2492-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-2847-0x0000000004ED0000-0x0000000004F10000-memory.dmp

Filesize
256KB

Download
memory/2208-10166-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Filesize
384KB

Download
memory/2208-4-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-10181-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-5-0x0000000004F10000-0x000000000518F000-memory.dmp

Filesize
2.5MB

Download
memory/2208-3-0x0000000004F10000-0x0000000005194000-memory.dmp

Filesize
2.5MB

Download
memory/2208-2-0x0000000004ED0000-0x0000000004F10000-memory.dmp

Filesize
256KB

Download
memory/2208-1-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download