purecrypter | 0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 18:49

Target

0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe
Size

335KB
MD5

17783c63b34cb560cee2219a5a718511
SHA1

0653a57e59b4bbb9735d0c2f320bcf79c414ba82
SHA256

0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b
SHA512

4a95b7972343d13bdb5ef1ed2f9d5cad3725fbdcb2aefe44987a4eb5ffa49c76fa07b73c6cc205ca7d73c39f50dbb59a9c337b82c69bee25051f836c55061a59
SSDEEP

6144:lW8ABhSQBJd85Cnz4ny1+J6HRw2bLnZRo4G8u3i43FHm7p1:A8qdd85CnWycJ6HhTQ3M

Score

10^/10

Family

purecrypter

https://janiking.xyz/loader/uploads/Whotdf_Kzhgekln.png

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4488 set thread context of 2732	4488	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	86

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 2732	4488	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	86
PID 4488 wrote to memory of 2732	4488	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	86
PID 4488 wrote to memory of 2732	4488	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	86
PID 4488 wrote to memory of 2732	4488	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	86
PID 4488 wrote to memory of 2732	4488	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	86
PID 4488 wrote to memory of 2732	4488	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	86
PID 4488 wrote to memory of 2732	4488	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	86
PID 4488 wrote to memory of 2732	4488	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	86

C:\Users\Admin\AppData\Local\Temp\0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe
"C:\Users\Admin\AppData\Local\Temp\0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Users\Admin\AppData\Local\Temp\0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe
  "C:\Users\Admin\AppData\Local\Temp\0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2732

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
memory/2732-3-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2732-6-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/2732-8-0x00000000057B0000-0x00000000057C0000-memory.dmp

Filesize
64KB

Download
memory/2732-9-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/2732-10-0x00000000057B0000-0x00000000057C0000-memory.dmp

Filesize
64KB

Download
memory/4488-0-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/4488-1-0x0000000000B40000-0x0000000000B98000-memory.dmp

Filesize
352KB

Download
memory/4488-2-0x0000000001680000-0x000000000168A000-memory.dmp

Filesize
40KB

Download
memory/4488-7-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download