Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21-07-2024 01:30
Behavioral task
behavioral1
Sample
41bfcac136ff8f5d232419298ec7b6e0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
41bfcac136ff8f5d232419298ec7b6e0N.exe
Resource
win10v2004-20240709-en
General
-
Target
41bfcac136ff8f5d232419298ec7b6e0N.exe
-
Size
2.5MB
-
MD5
41bfcac136ff8f5d232419298ec7b6e0
-
SHA1
ced165b12d38356915b64a083ec6c88633572c96
-
SHA256
19c9916b59cb8573f64f15a1fa11e1704d24539cddad2559579ec4aff203c46c
-
SHA512
5f8383fe13d662500dd44565821ac5299b4aaa23e864010f451db04130ce91d2fb1ebe652887abb04be98729cdb05b1f352e39a6de1d3479b46a4194dc900e5b
-
SSDEEP
49152:R5HDi1U52tdpGLi83D26M0Mn4QpcGvM0JZ4DKYW/IVStzY4cU+rb:fHDi1U52tdbCD60wp5E0JZ/7Aoz5w
Malware Config
Signatures
-
PureLog Stealer
PureLog Stealer is an infostealer written in C#.
-
PureLog Stealer payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/464-1-0x0000000000AC0000-0x0000000000D46000-memory.dmp family_purelog_stealer -
Suspicious use of SetThreadContext 1 IoCs
Processes:
41bfcac136ff8f5d232419298ec7b6e0N.exedescription pid process target process PID 464 set thread context of 2540 464 41bfcac136ff8f5d232419298ec7b6e0N.exe 41bfcac136ff8f5d232419298ec7b6e0N.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
41bfcac136ff8f5d232419298ec7b6e0N.exe41bfcac136ff8f5d232419298ec7b6e0N.exedescription pid process Token: SeDebugPrivilege 464 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeDebugPrivilege 464 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeDebugPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeBackupPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeBackupPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeBackupPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeBackupPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeBackupPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeBackupPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeBackupPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeBackupPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeBackupPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeBackupPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeBackupPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeBackupPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeSecurityPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe Token: SeBackupPrivilege 2540 41bfcac136ff8f5d232419298ec7b6e0N.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
41bfcac136ff8f5d232419298ec7b6e0N.exedescription pid process target process PID 464 wrote to memory of 2540 464 41bfcac136ff8f5d232419298ec7b6e0N.exe 41bfcac136ff8f5d232419298ec7b6e0N.exe PID 464 wrote to memory of 2540 464 41bfcac136ff8f5d232419298ec7b6e0N.exe 41bfcac136ff8f5d232419298ec7b6e0N.exe PID 464 wrote to memory of 2540 464 41bfcac136ff8f5d232419298ec7b6e0N.exe 41bfcac136ff8f5d232419298ec7b6e0N.exe PID 464 wrote to memory of 2540 464 41bfcac136ff8f5d232419298ec7b6e0N.exe 41bfcac136ff8f5d232419298ec7b6e0N.exe PID 464 wrote to memory of 2540 464 41bfcac136ff8f5d232419298ec7b6e0N.exe 41bfcac136ff8f5d232419298ec7b6e0N.exe PID 464 wrote to memory of 2540 464 41bfcac136ff8f5d232419298ec7b6e0N.exe 41bfcac136ff8f5d232419298ec7b6e0N.exe PID 464 wrote to memory of 2540 464 41bfcac136ff8f5d232419298ec7b6e0N.exe 41bfcac136ff8f5d232419298ec7b6e0N.exe PID 464 wrote to memory of 2540 464 41bfcac136ff8f5d232419298ec7b6e0N.exe 41bfcac136ff8f5d232419298ec7b6e0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41bfcac136ff8f5d232419298ec7b6e0N.exe"C:\Users\Admin\AppData\Local\Temp\41bfcac136ff8f5d232419298ec7b6e0N.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\41bfcac136ff8f5d232419298ec7b6e0N.exe"C:\Users\Admin\AppData\Local\Temp\41bfcac136ff8f5d232419298ec7b6e0N.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\41bfcac136ff8f5d232419298ec7b6e0N.exe.log
Filesize716B
MD5a92a2835b20b01436fb6517e97090bb1
SHA11a179d6b4018cc896708aa112b9d683176ba59b9
SHA256807a02aa126863cf5b802851a3b42d233a856346c0fb13517236815a1764e963
SHA512ef51b2bcfa1cdd33a02176d87b609f8ea4a6c4cfcf69094e88459a19bd1c187872b3a789a46e28869dad63f559cab8d51ac1125a172d71c477f3dd0ec60550a9