Analysis
- max time kernel
93s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
22/04/2024, 03:42
General
- Target Lisect_AV-T_G3_3.exe
- Size 8KB
- Sample240422-d9qm4afa72
- SHA256 af75b4c2edcbdb3127688168e7e712bdc8deec4b918619f4b14163b1fa049c60
Malware Config
Signatures
- PureLog Stealer
PureLog Stealer is an infostealer written in C#.
- PureLog Stealer payload 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Lisect_AV-T_G3_3.exe"C:\Users\Admin\AppData\Local\Temp\Lisect_AV-T_G3_3.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\cmdl32.exe"C:\Windows\SysWOW64\cmdl32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2272-14-0x0000000074C50000-0x0000000075400000-memory.dmp
memory/2272-1-0x0000000074C50000-0x0000000075400000-memory.dmp
memory/2272-2-0x00000000059F0000-0x0000000005F94000-memory.dmp
memory/2272-3-0x0000000005460000-0x0000000005470000-memory.dmp
memory/2272-4-0x0000000006200000-0x0000000006292000-memory.dmp
memory/2272-5-0x0000000006560000-0x000000000656A000-memory.dmp
memory/2272-6-0x0000000007210000-0x0000000007290000-memory.dmp
memory/2272-7-0x0000000007300000-0x0000000007368000-memory.dmp
memory/2272-8-0x0000000007490000-0x00000000074F6000-memory.dmp
memory/2272-9-0x0000000007500000-0x000000000754C000-memory.dmp
memory/2272-10-0x0000000074C50000-0x0000000075400000-memory.dmp
memory/2272-11-0x0000000005460000-0x0000000005470000-memory.dmp
memory/2272-0-0x0000000000B40000-0x0000000000B48000-memory.dmp
memory/3220-15-0x0000000000E80000-0x00000000011CA000-memory.dmp
memory/3220-23-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3220-16-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3220-17-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3220-18-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3220-19-0x0000000000E10000-0x0000000000E33000-memory.dmp
memory/3220-12-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3220-24-0x0000000000E10000-0x0000000000E33000-memory.dmp
memory/3448-20-0x000000000D5B0000-0x000000000FDEB000-memory.dmp
memory/3448-28-0x000000000D5B0000-0x000000000FDEB000-memory.dmp
memory/5092-22-0x0000000000400000-0x000000000043A000-memory.dmp
memory/5092-21-0x0000000000400000-0x000000000043A000-memory.dmp
memory/5092-25-0x0000000002530000-0x000000000287A000-memory.dmp
memory/5092-26-0x0000000000400000-0x000000000043A000-memory.dmp
memory/5092-27-0x0000000002280000-0x0000000002322000-memory.dmp
memory/5092-29-0x0000000000400000-0x000000000043A000-memory.dmp