Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
17-06-2024 01:01
General
-
Target
New RFQ 0100024.exe
-
Size
11KB
-
MD5
34e104205244cdd76c3420d734066b02
-
SHA1
8a3e1a2736de563e2f32abe631db0be24e992b16
-
SHA256
471e1552c28823dc7f3fe17abde8666e573db5d41b030aa3c46acb92f0aa7512
-
SHA512
f5f37381493da8adb036290927067aefb939544fc52de13c1f116c97b76a139fde07cfa5ed123a4af9a12994abfccd88e9219b6f7b4dc2c021a9fc15bc9c70b0
-
SSDEEP
96:Yf3HO3KJey0wOmtFHBRl4gYxuT40VYglYdCVzUg4pZOnENiUgzNt:u3OXrenRT40VuwVgg4pZ/N9i
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://www.vascocorretora.com.br/PPI/Xarooah.vdf
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New RFQ 0100024.exe"C:\Users\Admin\AppData\Local\Temp\New RFQ 0100024.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3064-0-0x0000000074BDE000-0x0000000074BDF000-memory.dmpFilesize
4KB
-
memory/3064-1-0x0000000000110000-0x0000000000118000-memory.dmpFilesize
32KB
-
memory/3064-2-0x0000000074BD0000-0x00000000752BE000-memory.dmpFilesize
6.9MB
-
memory/3064-3-0x0000000074BDE000-0x0000000074BDF000-memory.dmpFilesize
4KB
-
memory/3064-4-0x0000000074BD0000-0x00000000752BE000-memory.dmpFilesize
6.9MB