Analysis
- max time kernel
148s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20231127-en - resource tags
- submitted
01/12/2023, 15:15
General
- Target f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45.exe
- Size 6.4MB
- Sample231201-snee9sca4w
- SHA256 f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45
Malware Config
Signatures
- Detect PureLogs payload 1 IoCs
- PureLogs
PureLogs is an infostealer written in C#.
- Modifies registry class 3 IoCs
- NTFS ADS 3 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45.exe"C:\Users\Admin\AppData\Local\Temp\f078a97ea1930e7e0dae2c672f0cc9e72c56b811f3198c7311949c1463a93a45.exe"1⤵
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5072-0-0x0000000074CA0000-0x0000000075450000-memory.dmp
memory/5072-1-0x00000000009D0000-0x000000000103A000-memory.dmp
memory/5072-2-0x0000000005A30000-0x0000000005A96000-memory.dmp
memory/5072-3-0x0000000005B10000-0x0000000005B20000-memory.dmp
memory/5072-9-0x0000000006B60000-0x0000000007104000-memory.dmp
memory/5072-10-0x0000000006660000-0x00000000066E2000-memory.dmp
memory/5072-11-0x0000000006700000-0x000000000671A000-memory.dmp
memory/5072-12-0x0000000006720000-0x00000000067FC000-memory.dmp
memory/5072-13-0x00000000068F0000-0x00000000069BE000-memory.dmp
memory/5072-14-0x0000000007730000-0x0000000007D48000-memory.dmp
memory/5072-15-0x0000000006A60000-0x0000000006AF2000-memory.dmp
memory/5072-16-0x0000000074CA0000-0x0000000075450000-memory.dmp