purecrypter | dca1522e2127fb2f138754022464e2803adf6f17034a907ef1e2247f715733fc

General

Target

b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
Size

10KB
MD5

b0ee6e646cfcfde3772f06db28198b50
SHA1

6a8c094cfb3f6ba0c333018e48ce1241607a3418
SHA256

dca1522e2127fb2f138754022464e2803adf6f17034a907ef1e2247f715733fc
SHA512

571b5db1642d0eebf93f8ed588fe662654f2465ff66eaf55b8878a3cffda5d077045db6dfa376899f867e5d71a313ac307d868e640f473c293a73a4ea60cc7ca
SSDEEP

192:rx1QE6hCVFH+h4WiFvh+vg0+0i4oIKAm8O4RxP:HygFH+qbhx0O4GkO4Rx

Score

10^/10

purecrypter downloader loader persistence spyware stealer

Malware Config

Extracted

Family

purecrypter

C2

https://www.vascocorretora.com.br/PPI/Scnpbbezkc.vdf

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdertyh = "C:\\Users\\Admin\\AppData\\Roaming\\wdertyh.exe"	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe

description	pid	process	target process
PID 4036 set thread context of 2532	4036	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe

pid	process
2532	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
2532	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
2532	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
2532	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
2532	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
2532	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exeb0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe

description	pid	process
Token: SeDebugPrivilege	4036	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
Token: SeDebugPrivilege	4036	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
Token: SeDebugPrivilege	2532	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe

description	pid	process	target process
PID 4036 wrote to memory of 2532	4036	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
PID 4036 wrote to memory of 2532	4036	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
PID 4036 wrote to memory of 2532	4036	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
PID 4036 wrote to memory of 2532	4036	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
PID 4036 wrote to memory of 2532	4036	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
PID 4036 wrote to memory of 2532	4036	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
PID 4036 wrote to memory of 2532	4036	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
PID 4036 wrote to memory of 2532	4036	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe	b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036

C:\Users\Admin\AppData\Local\Temp\b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1432 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:392

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\b0ee6e646cfcfde3772f06db28198b50_NeikiAnalytics.exe.log
Filesize
1KB

MD5
f3eb81974dc5933681e933f07209ff5f

SHA1
7af8cae0f1d03e82daaf784df9886705685baac7

SHA256
e82069884dd428bd6a1c67fe00c5fa56f9c4d62b538b694694a699588f1f4ab2

SHA512
d9aa3871dffb76c8a73a7940fa03bbc9b65cf575cbd07f7c1fbf490cb0f3d670415eaef0bf79e34689f61ab3cdfbb104efdef004becc12e54b501f02f948aaff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jhwsmivcsa.tmpdb
Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
memory/2532-4902-0x0000000000540000-0x0000000000618000-memory.dmp

Filesize
864KB

Download
memory/2532-4903-0x0000000004BE0000-0x0000000004CF6000-memory.dmp

Filesize
1.1MB

Download
memory/2532-4904-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/2532-4906-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/2532-7230-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/2532-7200-0x0000000005EA0000-0x0000000005F1A000-memory.dmp

Filesize
488KB

Download
memory/2532-7199-0x00000000055E0000-0x0000000005646000-memory.dmp

Filesize
408KB

Download
memory/2532-7198-0x00000000051D0000-0x00000000051FC000-memory.dmp

Filesize
176KB

Download
memory/2532-7197-0x0000000004E30000-0x0000000004ECE000-memory.dmp

Filesize
632KB

Download
memory/4036-37-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-25-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-53-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-61-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-69-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-67-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-65-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-63-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-59-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-57-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-55-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-51-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-49-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-47-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-43-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-41-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-39-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-15-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-35-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-33-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-31-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-29-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-27-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-7-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-23-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-45-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-19-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-17-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-13-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-11-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-9-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-21-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-6-0x0000000008990000-0x0000000008C76000-memory.dmp

Filesize
2.9MB

Download
memory/4036-4892-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/4036-4893-0x00000000010C0000-0x00000000011E8000-memory.dmp

Filesize
1.2MB

Download
memory/4036-4894-0x0000000000F40000-0x0000000000F8C000-memory.dmp

Filesize
304KB

Download
memory/4036-4895-0x000000007529E000-0x000000007529F000-memory.dmp

Filesize
4KB

Download
memory/4036-4896-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/4036-5-0x0000000008E20000-0x0000000008EB2000-memory.dmp

Filesize
584KB

Download
memory/4036-4-0x0000000009230000-0x00000000097D4000-memory.dmp

Filesize
5.6MB

Download
memory/4036-3-0x0000000008990000-0x0000000008C7C000-memory.dmp

Filesize
2.9MB

Download
memory/4036-2-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download
memory/4036-1-0x0000000000870000-0x0000000000878000-memory.dmp

Filesize
32KB

Download
memory/4036-0-0x000000007529E000-0x000000007529F000-memory.dmp

Filesize
4KB

Download
memory/4036-4897-0x0000000000FC0000-0x0000000001014000-memory.dmp

Filesize
336KB

Download
memory/4036-4905-0x0000000075290000-0x0000000075A40000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads