Analysis
-
max time kernel
130s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 13:36
Behavioral task
behavioral1
Sample
MTQ_0612065_016.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
MTQ_0612065_016.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
MTQ_0612065_016.exe
-
Size
332KB
-
MD5
1e000d97122cd44f3805592902e505ae
-
SHA1
94003b97739d0d4f2776361f82dc3e9a3f744ee6
-
SHA256
7a85ba084aff19a5ec83585bfd53a03f3d3214c1978f8058e4d6dc57f5b1546e
-
SHA512
484acfd728b8609b8c1a64c1772f5530d5cca99b3f4f8b1365a36d096b8ebac9977b2577656ff64489435ec6635491a796c26a281a4ca6f9bf92d420fc25f7ad
-
SSDEEP
6144:s1LUaHsGL8UYss61pZnFUw0s32WzNprLespyzUsMf0f:sKafGezNprrf0f
Score
10/10
Malware Config
Signatures
-
PureLog Stealer
PureLog Stealer is an infostealer written in C#.
-
PureLog Stealer payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2180-1-0x00000000003B0000-0x000000000040A000-memory.dmp family_purelog_stealer -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MTQ_0612065_016.exedescription pid process Token: SeDebugPrivilege 2180 MTQ_0612065_016.exe