purecrypter | 99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a

General

Target

99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
Size

6KB
MD5

1c56623199e1959f271a191d603360bf
SHA1

9a7429e8b08ef843739c7739e8a314006c20b2af
SHA256

99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a
SHA512

87c50fb8f13d5b0ce5d83d99e64a7728e466e33118faea4c52136dd8a2f70d5f4217c90f4cc3c415628b9f96b7ed114cedb2455e3edc1cc39e67a36b79fceee4
SSDEEP

96:QhN/c/kk91xUL9678Ms0wFFpBV4Xh4yvn1j4r/8iT85fTc70zNt:QhN/cx1o96hwFH4R4viRM+

Score

10^/10

purecrypter downloader loader persistence spyware stealer

Malware Config

Extracted

Family

purecrypter

C2

http://103.195.103.33/nf/Qtdxulkcon.wav

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Gljzdykchd = "C:\\Users\\Admin\\AppData\\Roaming\\Gljzdykchd.exe"	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe

description	pid	process	target process
PID 3040 set thread context of 5292	3040	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe

pid	process
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe

description	pid	process
Token: SeDebugPrivilege	3040	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
Token: SeDebugPrivilege	3040	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
Token: SeDebugPrivilege	5292	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe

description	pid	process	target process
PID 3040 wrote to memory of 5292	3040	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
PID 3040 wrote to memory of 5292	3040	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
PID 3040 wrote to memory of 5292	3040	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
PID 3040 wrote to memory of 5292	3040	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
PID 3040 wrote to memory of 5292	3040	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
PID 3040 wrote to memory of 5292	3040	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
PID 3040 wrote to memory of 5292	3040	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
PID 3040 wrote to memory of 5292	3040	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe	99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe

C:\Users\Admin\AppData\Local\Temp\99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
"C:\Users\Admin\AppData\Local\Temp\99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040

C:\Users\Admin\AppData\Local\Temp\99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe
"C:\Users\Admin\AppData\Local\Temp\99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4468 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5528

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\99fce21d1aa81f7f3b8fae707aabd43b5b51b9da0fbb7258b68bd5fe9d62073a.exe.log
Filesize
1KB

MD5
f3eb81974dc5933681e933f07209ff5f

SHA1
7af8cae0f1d03e82daaf784df9886705685baac7

SHA256
e82069884dd428bd6a1c67fe00c5fa56f9c4d62b538b694694a699588f1f4ab2

SHA512
d9aa3871dffb76c8a73a7940fa03bbc9b65cf575cbd07f7c1fbf490cb0f3d670415eaef0bf79e34689f61ab3cdfbb104efdef004becc12e54b501f02f948aaff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fgvzo.tmpdb
Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
memory/3040-0-0x0000000074D0E000-0x0000000074D0F000-memory.dmp

Filesize
4KB

Download
memory/3040-1-0x00000000007B0000-0x00000000007B8000-memory.dmp

Filesize
32KB

Download
memory/3040-2-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/3040-3-0x00000000087B0000-0x0000000008A9C000-memory.dmp

Filesize
2.9MB

Download
memory/3040-4-0x0000000009050000-0x00000000095F4000-memory.dmp

Filesize
5.6MB

Download
memory/3040-5-0x0000000008B40000-0x0000000008BD2000-memory.dmp

Filesize
584KB

Download
memory/3040-17-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-27-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-35-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-47-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-45-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-43-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-41-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-37-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-33-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-31-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-29-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-25-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-39-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-23-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-21-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-19-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-15-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-13-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-11-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-9-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-7-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-6-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-69-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-67-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-65-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-63-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-61-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-59-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-57-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-55-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-53-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-51-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-49-0x00000000087B0000-0x0000000008A96000-memory.dmp

Filesize
2.9MB

Download
memory/3040-4892-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/3040-4893-0x0000000001050000-0x0000000001178000-memory.dmp

Filesize
1.2MB

Download
memory/3040-4894-0x0000000000F80000-0x0000000000FCC000-memory.dmp

Filesize
304KB

Download
memory/3040-4895-0x0000000074D0E000-0x0000000074D0F000-memory.dmp

Filesize
4KB

Download
memory/3040-4896-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/3040-4897-0x0000000000FE0000-0x0000000001034000-memory.dmp

Filesize
336KB

Download
memory/3040-4904-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/5292-4902-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5292-4903-0x00000000055C0000-0x00000000056D6000-memory.dmp

Filesize
1.1MB

Download
memory/5292-4905-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/5292-4906-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/5292-7243-0x0000000005890000-0x000000000592E000-memory.dmp

Filesize
632KB

Download
memory/5292-7244-0x0000000005F50000-0x0000000005F7C000-memory.dmp

Filesize
176KB

Download
memory/5292-7245-0x0000000005FF0000-0x0000000006056000-memory.dmp

Filesize
408KB

Download
memory/5292-7246-0x0000000006900000-0x000000000697A000-memory.dmp

Filesize
488KB

Download
memory/5292-7276-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads