Overview

overview

10

Static

static

10

b0ee6e646c...cs.exe

windows7-x64

10

b0ee6e646c...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 09:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe

  • Size

    10KB

  • MD5

    b0ee6e646cfcfde3772f06db28198b50

  • SHA1

    6a8c094cfb3f6ba0c333018e48ce1241607a3418

  • SHA256

    dca1522e2127fb2f138754022464e2803adf6f17034a907ef1e2247f715733fc

  • SHA512

    571b5db1642d0eebf93f8ed588fe662654f2465ff66eaf55b8878a3cffda5d077045db6dfa376899f867e5d71a313ac307d868e640f473c293a73a4ea60cc7ca

  • SSDEEP

    192:rx1QE6hCVFH+h4WiFvh+vg0+0i4oIKAm8O4RxP:HygFH+qbhx0O4GkO4Rx

Score
10/10
purecrypterdownloaderloader

Malware Config

Extracted

Family

purecrypter

C2

https://www.vascocorretora.com.br/PPI/Scnpbbezkc.vdf

Signatures

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2216-0-0x00000000742BE000-0x00000000742BF000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2216-1-0x0000000000AB0000-0x0000000000AB8000-memory.dmp
    Filesize

    32KB

    Download
  • memory/2216-2-0x00000000742B0000-0x000000007499E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2216-3-0x00000000742BE000-0x00000000742BF000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2216-4-0x00000000742B0000-0x000000007499E000-memory.dmp
    Filesize

    6.9MB

    Download