Analysis
- max time kernel
121s - max time network
121s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
- submitted
17/05/2024, 16:51
General
- Target 305dca2184069473413661e6fe608cfa.exe
- Size 2.4MB
- Sample240517-vcs6dshc48
- SHA256 cbcf33d26c498de5cf96469fa600ee72dbd7d62d1dfad165c60183fc598cdc66
Malware Config
Signatures
- PureLog Stealer
PureLog Stealer is an infostealer written in C#.
- PureLog Stealer payload 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Modifies system certificate store 2 TTPs 6 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\305dca2184069473413661e6fe608cfa.exe"C:\Users\Admin\AppData\Local\Temp\305dca2184069473413661e6fe608cfa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\305dca2184069473413661e6fe608cfa.exe"C:\Users\Admin\AppData\Local\Temp\305dca2184069473413661e6fe608cfa.exe"2⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
Cab4462.tmp
Tar45A1.tmp
memory/2032-4907-0x0000000000090000-0x0000000000110000-memory.dmp
memory/2032-4906-0x0000000074AA0000-0x000000007518E000-memory.dmp
memory/2032-4908-0x0000000074AA0000-0x000000007518E000-memory.dmp
memory/2032-4976-0x0000000074AA0000-0x000000007518E000-memory.dmp
memory/2032-4975-0x0000000074AA0000-0x000000007518E000-memory.dmp
memory/2316-48-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-38-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-6-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-10-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-20-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-46-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-52-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-56-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-62-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-68-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-8-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-66-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-64-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-60-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-58-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-54-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-50-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-4-0x0000000005280000-0x00000000054DE000-memory.dmp
memory/2316-44-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-42-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-40-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-5-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-36-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-34-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-32-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-30-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-28-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-26-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-24-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-22-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-18-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-16-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-14-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-12-0x0000000005280000-0x00000000054D7000-memory.dmp
memory/2316-3-0x0000000074AA0000-0x000000007518E000-memory.dmp
memory/2316-2-0x0000000005020000-0x000000000527E000-memory.dmp
memory/2316-1-0x00000000012B0000-0x0000000001524000-memory.dmp
memory/2316-0-0x0000000074AAE000-0x0000000074AAF000-memory.dmp
memory/2316-4886-0x0000000004E40000-0x0000000004E8C000-memory.dmp
memory/2316-4885-0x00000000011C0000-0x000000000125A000-memory.dmp
memory/2316-4888-0x0000000004E90000-0x0000000004EE4000-memory.dmp
memory/2316-4887-0x0000000074AA0000-0x000000007518E000-memory.dmp
memory/2316-4905-0x0000000074AA0000-0x000000007518E000-memory.dmp