purecrypter | c36f49ce80e9ad92355502e044e74966cdcb1fb64f98da33d23ffc98f80cb067

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2024 19:07

Target

Quotation V111K2V.exe
Size

6KB
MD5

ad918477a60ad0ec51338bd30df7bfdf
SHA1

06b780e231275bdcfc9bb9703bd7a70ede44a73c
SHA256

c36f49ce80e9ad92355502e044e74966cdcb1fb64f98da33d23ffc98f80cb067
SHA512

809c26b8c15fdf2c3229509a4874cda472515c4b456272068561e883e1d570eb3066b5762935c5c87d1304dbc4a1f395d2fbdeb2592545105c7696838d61df34
SSDEEP

96:Yp3HyAurB6y0+mtFqZYBRl4gLn40nyEDZDyYzNt:83uu+ewQJn40nyII6

Score

10^/10

Family

purecrypter

https://360.asesoriaenfarmacias.com/Rwnpjrqq.vdf

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Quotation V111K2V.exe

description pid process

Token: SeDebugPrivilege 4000 Quotation V111K2V.exe

description	pid	process
Token: SeDebugPrivilege	4000	Quotation V111K2V.exe

C:\Users\Admin\AppData\Local\Temp\Quotation V111K2V.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation V111K2V.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4000

memory/4000-0-0x000000007475E000-0x000000007475F000-memory.dmp

Filesize
4KB

Download
memory/4000-1-0x0000000000010000-0x0000000000018000-memory.dmp

Filesize
32KB

Download
memory/4000-2-0x0000000074750000-0x0000000074F00000-memory.dmp

Filesize
7.7MB

Download
memory/4000-3-0x000000007475E000-0x000000007475F000-memory.dmp

Filesize
4KB

Download
memory/4000-4-0x0000000074750000-0x0000000074F00000-memory.dmp

Filesize
7.7MB

Download