Analysis
- max time kernel
125s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
14/08/2024, 01:02
General
- Target 1d7c6ed697ee011ad969d1d7c706d88a962584f87d543fcc77ee358c5bfb4509.exe
- Size 1.9MB
- Sample240814-bd3lnstbna
- SHA256 1d7c6ed697ee011ad969d1d7c706d88a962584f87d543fcc77ee358c5bfb4509
Malware Config
Signatures
- PureLog Stealer
PureLog Stealer is an infostealer written in C#.
- PureLog Stealer payload 1 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\1d7c6ed697ee011ad969d1d7c706d88a962584f87d543fcc77ee358c5bfb4509.exe"C:\Users\Admin\AppData\Local\Temp\1d7c6ed697ee011ad969d1d7c706d88a962584f87d543fcc77ee358c5bfb4509.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Dqxtzpdqpx.tmpdb
Xxajziwbg.tmpdb
memory/4852-22-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-1079-0x0000000005CD0000-0x0000000005D1C000-memory.dmp
memory/4852-4-0x0000000005AD0000-0x0000000005C7A000-memory.dmp
memory/4852-5-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-18-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-44-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-46-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-52-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-68-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-66-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-64-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-60-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-58-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-56-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-54-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-50-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-62-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-48-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-14-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-41-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-38-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-36-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-34-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-30-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-28-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-26-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-24-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-32-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-3-0x0000000005820000-0x00000000059CC000-memory.dmp
memory/4852-0-0x000000007476E000-0x000000007476F000-memory.dmp
memory/4852-42-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-12-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-10-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-8-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-6-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-16-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-1077-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/4852-1078-0x0000000005F00000-0x0000000006024000-memory.dmp
memory/4852-20-0x0000000005AD0000-0x0000000005C73000-memory.dmp
memory/4852-1083-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/4852-1085-0x00000000068D0000-0x0000000006E74000-memory.dmp
memory/4852-1084-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/4852-1086-0x0000000005E20000-0x0000000005E74000-memory.dmp
memory/4852-1-0x0000000000C20000-0x0000000000E04000-memory.dmp
memory/4852-1090-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/4852-1091-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/4852-2-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/4932-1093-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/4932-1094-0x00000000054E0000-0x00000000055EE000-memory.dmp
memory/4932-3949-0x0000000005680000-0x000000000571E000-memory.dmp
memory/4932-3950-0x0000000005D70000-0x0000000005DBC000-memory.dmp
memory/4932-3951-0x0000000005A30000-0x0000000005A3A000-memory.dmp
memory/4932-3952-0x0000000005F70000-0x0000000005FD6000-memory.dmp
memory/4932-3953-0x0000000006500000-0x0000000006592000-memory.dmp
memory/4932-3954-0x00000000068F0000-0x000000000696A000-memory.dmp
memory/4932-1092-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/4932-1089-0x0000000000400000-0x00000000004D6000-memory.dmp
memory/4932-3990-0x0000000074760000-0x0000000074F10000-memory.dmp