Overview

overview

10

Static

static

10

5011f03924...a2.exe

windows7-x64

10

5011f03924...a2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-04-2024 18:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5011f03924e939955dd3868c86998398ce022fb726ec701921377bf13ea341a2.exe

  • Size

    13KB

  • MD5

    a1a52e047f098572bc4f1020cbe19970

  • SHA1

    f3b05c953cc2d459985e47f41609620cb4c59437

  • SHA256

    5011f03924e939955dd3868c86998398ce022fb726ec701921377bf13ea341a2

  • SHA512

    3a5914dc3655b53dcb36fbaf18ad170029c15933e4a9c0808a3c95179da6bff246a10dcf5cc048392dff988dc2ba3bde6f89f3a1ab9914b8c3535a95c8f70699

  • SSDEEP

    192:6ZYUc8f/ftGgkpErlc/vl20JFi1TTgJMRqIcuuufNva:6ZddGgkpSWxuTEKRdN

Score
10/10
purecrypterdownloaderloader

Malware Config

Extracted

Family

purecrypter

C2

https://a.pomf.cat/rfeokw.bmp

Signatures

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5011f03924e939955dd3868c86998398ce022fb726ec701921377bf13ea341a2.exe
    "C:\Users\Admin\AppData\Local\Temp\5011f03924e939955dd3868c86998398ce022fb726ec701921377bf13ea341a2.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1380-0-0x00000000007D0000-0x00000000007D8000-memory.dmp
    Filesize

    32KB

    Download
  • memory/1380-1-0x0000000074C30000-0x00000000753E0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/1380-2-0x00000000056D0000-0x0000000005C74000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/1380-3-0x0000000005280000-0x0000000005312000-memory.dmp
    Filesize

    584KB

    Download
  • memory/1380-4-0x0000000002AB0000-0x0000000002AC0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1380-5-0x0000000005250000-0x000000000525A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/1380-6-0x0000000074C30000-0x00000000753E0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/1380-7-0x0000000002AB0000-0x0000000002AC0000-memory.dmp
    Filesize

    64KB

    Download