Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
16/05/2024, 16:14
General
- Target c66aaf6b9b6dda608aa625be450e18db.exe
- Size 4.5MB
- Sample240516-tp5jhsdb38
- SHA256 e1563452082e8247f0b417639096ab9b29d22b41ca64d3671787c5f626a53c4a
Malware Config
Signatures
- PureLog Stealer
PureLog Stealer is an infostealer written in C#.
- PureLog Stealer payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c66aaf6b9b6dda608aa625be450e18db.exe"C:\Users\Admin\AppData\Local\Temp\c66aaf6b9b6dda608aa625be450e18db.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c66aaf6b9b6dda608aa625be450e18db.exe"C:\Users\Admin\AppData\Local\Temp\c66aaf6b9b6dda608aa625be450e18db.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\windows\explorere"C:\ProgramData\windows\explorere" {4B08985C-0E0F-4678-84A8-2A0974B289FF}3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\windows\explorere"C:\ProgramData\windows\explorere"4⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3772,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
explorere
memory/752-4895-0x0000000140000000-0x000000014006B000-memory.dmp
memory/752-4900-0x0000000140000000-0x000000014006B000-memory.dmp
memory/2452-0-0x00007FFC065C3000-0x00007FFC065C5000-memory.dmp
memory/2452-1-0x000001A27D210000-0x000001A27D696000-memory.dmp
memory/2452-2-0x000001A218000000-0x000001A218474000-memory.dmp
memory/2452-3-0x00007FFC065C0000-0x00007FFC07081000-memory.dmp
memory/2452-4-0x000001A27FD10000-0x000001A27FF4E000-memory.dmp
memory/2452-20-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-6-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-5-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-28-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-22-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-18-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-16-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-14-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-12-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-10-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-8-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-35-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-38-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-46-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-44-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-42-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-40-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-36-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-32-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-30-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-26-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-24-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-52-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-68-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-66-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-64-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-62-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-60-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-58-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-54-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-50-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-48-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-57-0x000001A27FD10000-0x000001A27FF48000-memory.dmp
memory/2452-4885-0x00007FFC065C0000-0x00007FFC07081000-memory.dmp
memory/2452-4887-0x000001A2196C0000-0x000001A21970C000-memory.dmp
memory/2452-4886-0x000001A219640000-0x000001A2196BA000-memory.dmp
memory/2452-4888-0x00007FFC065C3000-0x00007FFC065C5000-memory.dmp
memory/2452-4889-0x00007FFC065C0000-0x00007FFC07081000-memory.dmp
memory/2452-4890-0x000001A219710000-0x000001A219764000-memory.dmp
memory/2452-4896-0x00007FFC065C0000-0x00007FFC07081000-memory.dmp
memory/4172-4902-0x00007FFC065F3000-0x00007FFC065F5000-memory.dmp
memory/4172-4903-0x00007FFC065F0000-0x00007FFC070B1000-memory.dmp
memory/4172-9784-0x00007FFC065F3000-0x00007FFC065F5000-memory.dmp
memory/4172-9785-0x00007FFC065F0000-0x00007FFC070B1000-memory.dmp
memory/4172-9792-0x00007FFC065F0000-0x00007FFC070B1000-memory.dmp