Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
04/04/2024, 16:59
General
-
Target
REVISED FINAL ORDER LIST-pdf.exe
-
Size
32KB
-
MD5
5518dd63ae04917f0647f698d49f5c1a
-
SHA1
fdf1f3970ab95e67765517bb29b8e2dc06bfcc5e
-
SHA256
51b9a732f19371ba83e4d9f920665d7ff402a57782ff43fd447cff2c73c6397d
-
SHA512
297af2b964d802effa7ceda0a16027d3a63da84f581bdc5fa9bc6d668cb0fd5493931287e875f92f4fc8f769ffc68735ee62d3ccfa21882b44bd1947ee65bfe4
-
SSDEEP
384:DaONo4AbpW5tdzMOs4UQWEctJpoI7lZdS6/pCqomSDxr2QmUa3P4keIKDQckRKD9:DaO6/Q5t5rUzEcCUDfqxr294dT90PG+
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://store2.gofile.io/download/8ce405ad-0ec4-4b82-9f2d-8d4ceab524d7/Lotrcnlgrg.dll
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\REVISED FINAL ORDER LIST-pdf.exe"C:\Users\Admin\AppData\Local\Temp\REVISED FINAL ORDER LIST-pdf.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 16162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4748 -ip 47481⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
7.7MB