purelogs | 1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2023, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
Size 1.3MB
Sample231201-xq9fmsfc75
SHA256 1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94
MD5 5a66a38c855bee6f87fb1521e01f99ca
SHA1 a9fd0918d1b5860a10b758ff530e3702b5fdb922
SHA512 a3fde1b6c0e5fbb8822cb63be4b50c4050f3f713db3d26df1f1f85ee8c3cad95cd5146a172eef3c3532a547deacc80b2d46cc2e439ef0d2714bcbfc46cf8a73f
SSDEEP 24576:t5hPzLxxyJR6Xb2cacy6eCE9eRDVNUHs8V3ZkUAHa06L8gP:tHLLx4R8zZms7UA1gP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

purelogs stealer

Malware Config

Signatures

Detect PureLogs payload 1 IoCs

resource	yara_rule
behavioral2/memory/2176-0-0x0000000000B30000-0x0000000000C8E000-memory.dmp	family_purelogs

PureLogs
PureLogs is an infostealer written in C#.
stealer purelogs

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 5080	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	88
PID 2176 wrote to memory of 5080	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	88
PID 2176 wrote to memory of 5080	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	88
PID 2176 wrote to memory of 4080	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	95
PID 2176 wrote to memory of 4080	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	95
PID 2176 wrote to memory of 4080	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	95
PID 2176 wrote to memory of 4624	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	94
PID 2176 wrote to memory of 4624	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	94
PID 2176 wrote to memory of 4624	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	94
PID 2176 wrote to memory of 2148	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	89
PID 2176 wrote to memory of 2148	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	89
PID 2176 wrote to memory of 2148	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	89
PID 2176 wrote to memory of 4104	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	90
PID 2176 wrote to memory of 4104	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	90
PID 2176 wrote to memory of 4104	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	90
PID 2176 wrote to memory of 2096	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	91
PID 2176 wrote to memory of 2096	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	91
PID 2176 wrote to memory of 2096	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	91
PID 2176 wrote to memory of 1532	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	93
PID 2176 wrote to memory of 1532	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	93
PID 2176 wrote to memory of 1532	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	93
PID 2176 wrote to memory of 3024	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	92
PID 2176 wrote to memory of 3024	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	92
PID 2176 wrote to memory of 3024	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	92
PID 2176 wrote to memory of 5036	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	96
PID 2176 wrote to memory of 5036	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	96
PID 2176 wrote to memory of 5036	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	96
PID 2176 wrote to memory of 4744	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	97
PID 2176 wrote to memory of 4744	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	97
PID 2176 wrote to memory of 4744	2176	1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe	97

C:\Users\Admin\AppData\Local\Temp\1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe
"C:\Users\Admin\AppData\Local\Temp\1e902ccef38e9ca5562ed3dbdaeee3369780bbd27c295f7233e2c476cfa3ca94.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:5080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:2148
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:4104
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:2096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:3024
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:1532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:4624
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:4080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:5036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:4744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-0-0x0000000000B30000-0x0000000000C8E000-memory.dmp

Download

memory/2176-1-0x0000000074C30000-0x00000000753E0000-memory.dmp

Download

memory/2176-2-0x0000000005660000-0x000000000576E000-memory.dmp

Download

memory/2176-3-0x0000000005650000-0x0000000005660000-memory.dmp

Download

memory/2176-4-0x0000000005770000-0x0000000005866000-memory.dmp

Download

memory/2176-5-0x00000000059B0000-0x0000000005AA6000-memory.dmp

Download

memory/2176-6-0x0000000005AB0000-0x0000000005AFC000-memory.dmp

Download

memory/2176-7-0x0000000006110000-0x00000000066B4000-memory.dmp

Download

memory/2176-9-0x0000000074C30000-0x00000000753E0000-memory.dmp

Download