Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
17/05/2024, 01:24
General
- Target 50860b8fe0c539a7c04ad98b59acc3395f8036f693fbaae4dfdff2d09b5110c1.js
- Size 6KB
- Sample240517-bstbjsba77
- SHA256 50860b8fe0c539a7c04ad98b59acc3395f8036f693fbaae4dfdff2d09b5110c1
Malware Config
Signatures
- PureLog Stealer
PureLog Stealer is an infostealer written in C#.
- PureLog Stealer payload 2 IoCs
- Blocklisted process makes network request 3 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\50860b8fe0c539a7c04ad98b59acc3395f8036f693fbaae4dfdff2d09b5110c1.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\windows.exe"C:\Users\Admin\AppData\Roaming\windows.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\windows.exe"C:\Users\Admin\AppData\Roaming\windows.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\windows\explorere"C:\ProgramData\windows\explorere" {4B08985C-0E0F-4678-84A8-2A0974B289FF}4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\windows\explorere"C:\ProgramData\windows\explorere"5⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
windows.exe
memory/4536-4916-0x0000000140000000-0x000000014006B000-memory.dmp
memory/4536-4922-0x0000000140000000-0x000000014006B000-memory.dmp
memory/5048-88-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-26-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-24-0x0000018EF72B0000-0x0000018EF74EE000-memory.dmp
memory/5048-25-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-36-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-46-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-48-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-50-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-44-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-42-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-40-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-38-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-34-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-82-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-28-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-85-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-30-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-52-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-62-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-64-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-78-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-23-0x00007FF882520000-0x00007FF882FE1000-memory.dmp
memory/5048-22-0x0000018EF6DD0000-0x0000018EF7244000-memory.dmp
memory/5048-86-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-32-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-80-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-76-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-74-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-68-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-66-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-60-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-59-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-56-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-54-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-72-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-70-0x0000018EF72B0000-0x0000018EF74E8000-memory.dmp
memory/5048-4905-0x00007FF882520000-0x00007FF882FE1000-memory.dmp
memory/5048-4906-0x0000018EF86A0000-0x0000018EF871A000-memory.dmp
memory/5048-4907-0x0000018EF8720000-0x0000018EF876C000-memory.dmp
memory/5048-4908-0x00007FF882523000-0x00007FF882525000-memory.dmp
memory/5048-4909-0x00007FF882520000-0x00007FF882FE1000-memory.dmp
memory/5048-4910-0x0000018EF8770000-0x0000018EF87C4000-memory.dmp
memory/5048-21-0x0000018EDC550000-0x0000018EDC9D6000-memory.dmp
memory/5048-4917-0x00007FF882520000-0x00007FF882FE1000-memory.dmp
memory/5048-20-0x00007FF882523000-0x00007FF882525000-memory.dmp