Overview

overview

10

Static

static

10

b0ee6e646c...cs.exe

windows7-x64

10

b0ee6e646c...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe

  • Size

    10KB

  • Sample

    240619-lkk1basekm

  • MD5

    b0ee6e646cfcfde3772f06db28198b50

  • SHA1

    6a8c094cfb3f6ba0c333018e48ce1241607a3418

  • SHA256

    dca1522e2127fb2f138754022464e2803adf6f17034a907ef1e2247f715733fc

  • SHA512

    571b5db1642d0eebf93f8ed588fe662654f2465ff66eaf55b8878a3cffda5d077045db6dfa376899f867e5d71a313ac307d868e640f473c293a73a4ea60cc7ca

  • SSDEEP

    192:rx1QE6hCVFH+h4WiFvh+vg0+0i4oIKAm8O4RxP:HygFH+qbhx0O4GkO4Rx

Score
10/10
purecrypterdownloaderloaderpersistencespywarestealer

Malware Config

Extracted

Family

purecrypter

C2

https://www.vascocorretora.com.br/PPI/Scnpbbezkc.vdf

Targets

    • Target

      b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe

    • Size

      10KB

    • MD5

      b0ee6e646cfcfde3772f06db28198b50

    • SHA1

      6a8c094cfb3f6ba0c333018e48ce1241607a3418

    • SHA256

      dca1522e2127fb2f138754022464e2803adf6f17034a907ef1e2247f715733fc

    • SHA512

      571b5db1642d0eebf93f8ed588fe662654f2465ff66eaf55b8878a3cffda5d077045db6dfa376899f867e5d71a313ac307d868e640f473c293a73a4ea60cc7ca

    • SSDEEP

      192:rx1QE6hCVFH+h4WiFvh+vg0+0i4oIKAm8O4RxP:HygFH+qbhx0O4GkO4Rx

    Score
    10/10
    purecrypterdownloaderloaderpersistencespywarestealer

    • PureCrypter

      PureCrypter is a .NET malware loader first seen in early 2021.

      loaderdownloaderpurecrypter

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks