Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/08/2024, 22:05

General

  • Target

    bd911b9d45743fbae9aea401b5092b69b8e9a24952d3f06947ee6b307c76246e.exe

  • Size

    334KB

  • MD5

    fcfdf7e5aa5e94c0ff65487236fa0b0b

  • SHA1

    b9511c6841ffe7523b037098e7cec21f46486eb3

  • SHA256

    bd911b9d45743fbae9aea401b5092b69b8e9a24952d3f06947ee6b307c76246e

  • SHA512

    e61b25e184b0c55db0c9afb7fb7b1ac461e3b014f3fe896e91173ad7213f58f1522edfa82939e3cdf9c5a9575d3ed2966414df3c0ef5297c9dc9ca0cca17925b

  • SSDEEP

    3072:7lIpvlLmpAZufjaxAOi5jwGVDNsPZ19AGUYRJ8IVKYT1:7GRliRaKOiZwt19AGU4Vt

Score
10/10

Malware Config

Signatures

  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

  • PureLog Stealer payload 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd911b9d45743fbae9aea401b5092b69b8e9a24952d3f06947ee6b307c76246e.exe
    "C:\Users\Admin\AppData\Local\Temp\bd911b9d45743fbae9aea401b5092b69b8e9a24952d3f06947ee6b307c76246e.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2580-0-0x00007FF8FF573000-0x00007FF8FF575000-memory.dmp

    Filesize

    8KB

  • memory/2580-1-0x0000017AD7200000-0x0000017AD725A000-memory.dmp

    Filesize

    360KB

  • memory/2580-2-0x0000017AD7600000-0x0000017AD7656000-memory.dmp

    Filesize

    344KB

  • memory/2580-3-0x00007FF8FF570000-0x00007FF900031000-memory.dmp

    Filesize

    10.8MB

  • memory/2580-5-0x00007FF8FF570000-0x00007FF900031000-memory.dmp

    Filesize

    10.8MB