Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
22-11-2023 20:39
General
-
Target
202311218800-INV62009HX66549.scr.exe
-
Size
14KB
-
MD5
19395fea893e3dcea476504227d56be6
-
SHA1
f86b35526cd61c8aab3911b11ca692225e341906
-
SHA256
3fcb840d5e65fc86ed5637bdcbab0ecde764d360ebe18a5e5d6795811dc1c622
-
SHA512
567acf5e2be2482d923142c3bd574f79475abdcfd9f63768bfe5632fe43b9ebfde3b7865c2d1971eb922686deeac4322d1c627329c96621b0c3b31940586d724
-
SSDEEP
192:Uebp41yqqdcA32GG0s4LqVrTC+xV/knQi1oo79ED607RQ:UeboyqCZ2GGOLqVTfknQyMR
Malware Config
Extracted
purecrypter
https://teleturismo.it/wp-includes/Tzvgdu.vdf
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\202311218800-INV62009HX66549.scr.exe"C:\Users\Admin\AppData\Local\Temp\202311218800-INV62009HX66549.scr.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\202311218800-INV62009HX66549.scr.exeC:\Users\Admin\AppData\Local\Temp\202311218800-INV62009HX66549.scr.exe2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5159a40ccfd419bd60a20a1c278edaafd
SHA109bc35e46135b6b44c609fe6514ab7e2c8696a99
SHA25624487f4b6318683dcd81970e9f57fb45167575f687f7831a563176e20da657b6
SHA512b5c5b8c23479afff6b72c37c2cc1204c079ae003bae586d082d2b05acfdab8753fea78c5e53f692e4a45aba6746703d9ca99a2d0fa7bd88a7f35a910d1ad1ff3
-
Filesize
1.7MB
MD502f50a23e31d1f21aa21ae52faf3c05a
SHA15b21234729dedfa1b456138872ef2a046b9ee86f
SHA2565f0e72e1839db4aa41f560e0a68c7a95c9e1656bc2f4f4ff64803655d02e5272
SHA512bc2fcca125506d9b762df4e9df24a907b9e554d857e705945ae252e7e6b50dada043ef0e69828b780ac9b569053fcf912c27a770469a80f1f6094c146afdb9b0
-
Filesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
Filesize
124KB
MD59618e15b04a4ddb39ed6c496575f6f95
SHA11c28f8750e5555776b3c80b187c5d15a443a7412
SHA256a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
-
Filesize
1.0MB
-
Filesize
152KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
232KB
-
Filesize
432KB
-
Filesize
488KB
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
904KB
-
Filesize
2.1MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
32KB
-
Filesize
632KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB