purecrypter | 40541150d39975c60a7187ad81fe20ecf1525a8831ede5c735af2bb68cea4365

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
07-04-2024 22:35

Target

40541150d39975c60a7187ad81fe20ecf1525a8831ede5c735af2bb68cea4365.exe
Size

46KB
MD5

67fbec9b6576f967be0c088b209232e7
SHA1

bd3e79b8ec9bd9cc4aaaa276097e03f7fa26f813
SHA256

40541150d39975c60a7187ad81fe20ecf1525a8831ede5c735af2bb68cea4365
SHA512

f0de99a297f4e2eceb89dfc4c583dda1932f150807b60f16a6537a4fa51b413ed77ceb38567950c1a4f642e0a0f3516c977f489bb6e045a7c3e789d767eb960c
SSDEEP

768:J2zFjEXzmm86zx4KwEjq90PGTRYi6yqqAMxkElBdVS:MFeB4K9q90+TR7Bxx

Score

10^/10

Family

purecrypter

http://futilloiu.duckdns.org/byfronbypass.html/css/mss/Usokw.wav

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

40541150d39975c60a7187ad81fe20ecf1525a8831ede5c735af2bb68cea4365.exe

description pid process

Token: SeDebugPrivilege 1672 40541150d39975c60a7187ad81fe20ecf1525a8831ede5c735af2bb68cea4365.exe

description	pid	process
Token: SeDebugPrivilege	1672	40541150d39975c60a7187ad81fe20ecf1525a8831ede5c735af2bb68cea4365.exe

C:\Users\Admin\AppData\Local\Temp\40541150d39975c60a7187ad81fe20ecf1525a8831ede5c735af2bb68cea4365.exe
"C:\Users\Admin\AppData\Local\Temp\40541150d39975c60a7187ad81fe20ecf1525a8831ede5c735af2bb68cea4365.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1672

memory/1672-0-0x0000029BC47E0000-0x0000029BC47EA000-memory.dmp

Filesize
40KB

Download
memory/1672-1-0x00007FFC2C450000-0x00007FFC2CF12000-memory.dmp

Filesize
10.8MB

Download
memory/1672-2-0x0000029BDECE0000-0x0000029BDECF0000-memory.dmp

Filesize
64KB

Download
memory/1672-3-0x00007FFC2C450000-0x00007FFC2CF12000-memory.dmp

Filesize
10.8MB

Download