purecrypter | 0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b

General

Target

0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe
Size

335KB
MD5

17783c63b34cb560cee2219a5a718511
SHA1

0653a57e59b4bbb9735d0c2f320bcf79c414ba82
SHA256

0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b
SHA512

4a95b7972343d13bdb5ef1ed2f9d5cad3725fbdcb2aefe44987a4eb5ffa49c76fa07b73c6cc205ca7d73c39f50dbb59a9c337b82c69bee25051f836c55061a59
SSDEEP

6144:lW8ABhSQBJd85Cnz4ny1+J6HRw2bLnZRo4G8u3i43FHm7p1:A8qdd85CnWycJ6HhTQ3M

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

C2

https://janiking.xyz/loader/uploads/Whotdf_Kzhgekln.png

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3620 set thread context of 236	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe
3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe
3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe
3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe
Token: SeDebugPrivilege	236	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 2812	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	79
PID 3620 wrote to memory of 2812	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	79
PID 3620 wrote to memory of 2812	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	79
PID 3620 wrote to memory of 4824	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	80
PID 3620 wrote to memory of 4824	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	80
PID 3620 wrote to memory of 4824	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	80
PID 3620 wrote to memory of 236	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	81
PID 3620 wrote to memory of 236	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	81
PID 3620 wrote to memory of 236	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	81
PID 3620 wrote to memory of 236	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	81
PID 3620 wrote to memory of 236	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	81
PID 3620 wrote to memory of 236	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	81
PID 3620 wrote to memory of 236	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	81
PID 3620 wrote to memory of 236	3620	0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe	81

C:\Users\Admin\AppData\Local\Temp\0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe
"C:\Users\Admin\AppData\Local\Temp\0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Users\Admin\AppData\Local\Temp\0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe
  "C:\Users\Admin\AppData\Local\Temp\0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe"
  2⤵
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe
  "C:\Users\Admin\AppData\Local\Temp\0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe"
  2⤵
  PID:4824
- C:\Users\Admin\AppData\Local\Temp\0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe
  "C:\Users\Admin\AppData\Local\Temp\0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0cfe0c50487f6d372e650d4171b51dae5a085de9d604a6701c5ebec442268b5b.exe.log

Filesize
226B

MD5
1294de804ea5400409324a82fdc7ec59

SHA1
9a39506bc6cadf99c1f2129265b610c69d1518f7

SHA256
494398ec6108c68573c366c96aae23d35e7f9bdbb440a4aab96e86fcad5871d0

SHA512
033905cc5b4d0c0ffab2138da47e3223765146fa751c9f84b199284b653a04874c32a23aae577d2e06ce6c6b34fec62331b5fc928e3baf68dc53263ecdfa10c1

Download Submit
memory/236-3-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/236-4-0x00000000747C0000-0x0000000074F71000-memory.dmp

Filesize
7.7MB

Download
memory/236-8-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/236-9-0x00000000747C0000-0x0000000074F71000-memory.dmp

Filesize
7.7MB

Download
memory/236-10-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/3620-0-0x0000000000E20000-0x0000000000E78000-memory.dmp

Filesize
352KB

Download
memory/3620-1-0x0000000003210000-0x000000000321A000-memory.dmp

Filesize
40KB

Download
memory/3620-2-0x00000000747C0000-0x0000000074F71000-memory.dmp

Filesize
7.7MB

Download
memory/3620-7-0x00000000747C0000-0x0000000074F71000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing