Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-05-2024 14:17

General

  • Target

    5060aa947a34021253ae94af9e4442d1bcaf786214a2d7bc3abf7dbab82afffd.exe

  • Size

    365KB

  • MD5

    69c1fdf1333790e84965f9534358f624

  • SHA1

    758092a3b95cf4f57d7f9101f2d9c867789153ac

  • SHA256

    5060aa947a34021253ae94af9e4442d1bcaf786214a2d7bc3abf7dbab82afffd

  • SHA512

    b44ea0c51f2c81bb398a560afe7d84e53c94513389b4caba69f1617b7a0481bb76d7ec0cb96bc7a94cfaac1a11ea930380d537d9b47ce8e82b019cc6eeece246

  • SSDEEP

    6144:VUU0X/4NkNzC1iq1bTcpIRVdQhy+skUmKK89HQvsWEW47xV:VDOut+hy+skUmyusWE9

Score
10/10

Malware Config

Signatures

  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

  • PureLog Stealer payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5060aa947a34021253ae94af9e4442d1bcaf786214a2d7bc3abf7dbab82afffd.exe
    "C:\Users\Admin\AppData\Local\Temp\5060aa947a34021253ae94af9e4442d1bcaf786214a2d7bc3abf7dbab82afffd.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/212-0-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

    Filesize

    4KB

  • memory/212-1-0x0000000000BE0000-0x0000000000C3E000-memory.dmp

    Filesize

    376KB

  • memory/212-2-0x0000000074B40000-0x00000000752F0000-memory.dmp

    Filesize

    7.7MB

  • memory/212-3-0x0000000002FA0000-0x0000000002FA8000-memory.dmp

    Filesize

    32KB

  • memory/212-4-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

    Filesize

    4KB

  • memory/212-5-0x0000000074B40000-0x00000000752F0000-memory.dmp

    Filesize

    7.7MB