Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    30-03-2024 06:43

General

  • Target

    INQRY-71416-S2-1109972-pdf.exe

  • Size

    32KB

  • MD5

    5518dd63ae04917f0647f698d49f5c1a

  • SHA1

    fdf1f3970ab95e67765517bb29b8e2dc06bfcc5e

  • SHA256

    51b9a732f19371ba83e4d9f920665d7ff402a57782ff43fd447cff2c73c6397d

  • SHA512

    297af2b964d802effa7ceda0a16027d3a63da84f581bdc5fa9bc6d668cb0fd5493931287e875f92f4fc8f769ffc68735ee62d3ccfa21882b44bd1947ee65bfe4

  • SSDEEP

    384:DaONo4AbpW5tdzMOs4UQWEctJpoI7lZdS6/pCqomSDxr2QmUa3P4keIKDQckRKD9:DaO6/Q5t5rUzEcCUDfqxr294dT90PG+

Malware Config

Extracted

Family

purecrypter

C2

https://store2.gofile.io/download/8ce405ad-0ec4-4b82-9f2d-8d4ceab524d7/Lotrcnlgrg.dll

Signatures

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

  • Program crash 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INQRY-71416-S2-1109972-pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\INQRY-71416-S2-1109972-pdf.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 1540
      2⤵
      • Program crash
      PID:3048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1660-0-0x0000000000280000-0x000000000028E000-memory.dmp

    Filesize

    56KB

  • memory/1660-1-0x0000000073EF0000-0x00000000745DE000-memory.dmp

    Filesize

    6.9MB

  • memory/1660-2-0x0000000000510000-0x0000000000550000-memory.dmp

    Filesize

    256KB

  • memory/1660-3-0x0000000073EF0000-0x00000000745DE000-memory.dmp

    Filesize

    6.9MB