purelogstealer | 81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

976KB
MD5

902f14b6f32cc40a82d6a0f2c41208ec
SHA1

c01e5bc3e9dbb84a5b36841045055999fc0a16cf
SHA256

81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa
SHA512

d55e184309e122ffbe3097bfb64b3e23829228cd16030dca5856bfa1725bc60c2da04bf04c8919ca658ca4b7b03e4be6e6bc9240b5816903609969213be2f97c
SSDEEP

24576:1Ibj07xMVrpydHnnDfiDw8PZIykCu3oxmv2GX:1+ukYxDqnZTlns2

Score

10^/10

purelogstealer discovery persistence stealer

Malware Config

Signatures

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4124-1-0x00000000008D0000-0x00000000009CA000-memory.dmp	family_purelog_stealer
C:\ProgramData\uetjsdn\qrtxrt.exe	family_purelog_stealer

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

Processes:

file.exeqrtxrt.exeqrtxrt.exe

description	pid	process	target process
PID 4124 created 3540	4124	file.exe	Explorer.EXE
PID 864 created 3540	864	qrtxrt.exe	Explorer.EXE
PID 1852 created 3540	1852	qrtxrt.exe	Explorer.EXE

Executes dropped EXE 4 IoCs

Processes:

qrtxrt.exeqrtxrt.exeqrtxrt.exeqrtxrt.exe

pid process

864 qrtxrt.exe
3132 qrtxrt.exe
1852 qrtxrt.exe
1700 qrtxrt.exe

pid	process
864	qrtxrt.exe
3132	qrtxrt.exe
1852	qrtxrt.exe
1700	qrtxrt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

file.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\afasdfga = "C:\\Users\\Admin\\AppData\\Roaming\\afasdfga.exe"	file.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

file.exeqrtxrt.exeqrtxrt.exe

description	pid	process	target process
PID 4124 set thread context of 2444	4124	file.exe	file.exe
PID 864 set thread context of 3132	864	qrtxrt.exe	qrtxrt.exe
PID 1852 set thread context of 1700	1852	qrtxrt.exe	qrtxrt.exe

Drops file in Windows directory 1 IoCs

Processes:

file.exe

description ioc process

File created C:\Windows\Tasks\Test Task17.job file.exe

description	ioc	process
File created	C:\Windows\Tasks\Test Task17.job	file.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

qrtxrt.exeqrtxrt.exeqrtxrt.exeqrtxrt.exefile.exefile.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qrtxrt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qrtxrt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qrtxrt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qrtxrt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

file.exeqrtxrt.exeqrtxrt.exe

pid process

4124 file.exe
864 qrtxrt.exe
1852 qrtxrt.exe

pid	process
4124	file.exe
864	qrtxrt.exe
1852	qrtxrt.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

file.exeqrtxrt.exeqrtxrt.exe

description	pid	process
Token: SeDebugPrivilege	4124	file.exe
Token: SeDebugPrivilege	4124	file.exe
Token: SeDebugPrivilege	864	qrtxrt.exe
Token: SeDebugPrivilege	864	qrtxrt.exe
Token: SeDebugPrivilege	1852	qrtxrt.exe
Token: SeDebugPrivilege	1852	qrtxrt.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

file.exeqrtxrt.exeqrtxrt.exe

description	pid	process	target process
PID 4124 wrote to memory of 2444	4124	file.exe	file.exe
PID 4124 wrote to memory of 2444	4124	file.exe	file.exe
PID 4124 wrote to memory of 2444	4124	file.exe	file.exe
PID 4124 wrote to memory of 2444	4124	file.exe	file.exe
PID 4124 wrote to memory of 2444	4124	file.exe	file.exe
PID 4124 wrote to memory of 2444	4124	file.exe	file.exe
PID 4124 wrote to memory of 2444	4124	file.exe	file.exe
PID 4124 wrote to memory of 2444	4124	file.exe	file.exe
PID 864 wrote to memory of 3132	864	qrtxrt.exe	qrtxrt.exe
PID 864 wrote to memory of 3132	864	qrtxrt.exe	qrtxrt.exe
PID 864 wrote to memory of 3132	864	qrtxrt.exe	qrtxrt.exe
PID 864 wrote to memory of 3132	864	qrtxrt.exe	qrtxrt.exe
PID 864 wrote to memory of 3132	864	qrtxrt.exe	qrtxrt.exe
PID 864 wrote to memory of 3132	864	qrtxrt.exe	qrtxrt.exe
PID 864 wrote to memory of 3132	864	qrtxrt.exe	qrtxrt.exe
PID 864 wrote to memory of 3132	864	qrtxrt.exe	qrtxrt.exe
PID 1852 wrote to memory of 1700	1852	qrtxrt.exe	qrtxrt.exe
PID 1852 wrote to memory of 1700	1852	qrtxrt.exe	qrtxrt.exe
PID 1852 wrote to memory of 1700	1852	qrtxrt.exe	qrtxrt.exe
PID 1852 wrote to memory of 1700	1852	qrtxrt.exe	qrtxrt.exe
PID 1852 wrote to memory of 1700	1852	qrtxrt.exe	qrtxrt.exe
PID 1852 wrote to memory of 1700	1852	qrtxrt.exe	qrtxrt.exe
PID 1852 wrote to memory of 1700	1852	qrtxrt.exe	qrtxrt.exe
PID 1852 wrote to memory of 1700	1852	qrtxrt.exe	qrtxrt.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3540
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4124
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2444
- C:\ProgramData\uetjsdn\qrtxrt.exe
  "C:\ProgramData\uetjsdn\qrtxrt.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3132
- C:\ProgramData\uetjsdn\qrtxrt.exe
  "C:\ProgramData\uetjsdn\qrtxrt.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1700

C:\ProgramData\uetjsdn\qrtxrt.exe
C:\ProgramData\uetjsdn\qrtxrt.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864

C:\ProgramData\uetjsdn\qrtxrt.exe
C:\ProgramData\uetjsdn\qrtxrt.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\uetjsdn\qrtxrt.exe

Filesize
976KB

MD5
902f14b6f32cc40a82d6a0f2c41208ec

SHA1
c01e5bc3e9dbb84a5b36841045055999fc0a16cf

SHA256
81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa

SHA512
d55e184309e122ffbe3097bfb64b3e23829228cd16030dca5856bfa1725bc60c2da04bf04c8919ca658ca4b7b03e4be6e6bc9240b5816903609969213be2f97c

Download Submit
C:\Windows\Tasks\Test Task17.job

Filesize
240B

MD5
827bcbe2efea6d4eafb7264299d86132

SHA1
b4a461517f4a0d7fad65d0516d01ae222d052adb

SHA256
84d9ac7b204c1e0e786919d2c57febc360271c7b5fc429f3ca1685c1294e2088

SHA512
9463716ee5454d670fb2199131e6b743401f51f9c44a1ab9b2a7be4fbf476c140dc636f6a2dc8b46d10286305094bf4184add5657af30c014433281b870886a5

Download Submit
memory/864-2173-0x0000000074170000-0x0000000074920000-memory.dmp

Filesize
7.7MB

Download
memory/864-1100-0x0000000074170000-0x0000000074920000-memory.dmp

Filesize
7.7MB

Download
memory/864-2190-0x0000000074170000-0x0000000074920000-memory.dmp

Filesize
7.7MB

Download
memory/864-1099-0x000000007417E000-0x000000007417F000-memory.dmp

Filesize
4KB

Download
memory/864-2181-0x0000000074170000-0x0000000074920000-memory.dmp

Filesize
7.7MB

Download
memory/864-2180-0x000000007417E000-0x000000007417F000-memory.dmp

Filesize
4KB

Download
memory/864-2179-0x0000000074170000-0x0000000074920000-memory.dmp

Filesize
7.7MB

Download
memory/864-2178-0x0000000074170000-0x0000000074920000-memory.dmp

Filesize
7.7MB

Download
memory/864-2177-0x0000000074170000-0x0000000074920000-memory.dmp

Filesize
7.7MB

Download
memory/2444-1094-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3132-2188-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4124-34-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-20-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-68-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-64-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-62-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-58-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-56-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-54-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-52-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-50-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-48-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-46-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-44-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-42-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-40-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-39-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-36-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-60-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-32-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-30-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-26-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-24-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-22-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-66-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-18-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-16-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-12-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-10-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-8-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-6-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-1077-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download
memory/4124-1079-0x00000000054A0000-0x00000000054EC000-memory.dmp

Filesize
304KB

Download
memory/4124-1078-0x00000000055F0000-0x0000000005648000-memory.dmp

Filesize
352KB

Download
memory/4124-1083-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download
memory/4124-5-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-15-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-28-0x0000000005500000-0x00000000055D6000-memory.dmp

Filesize
856KB

Download
memory/4124-4-0x0000000005500000-0x00000000055DC000-memory.dmp

Filesize
880KB

Download
memory/4124-3-0x0000000005300000-0x00000000053DC000-memory.dmp

Filesize
880KB

Download
memory/4124-2-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download
memory/4124-1-0x00000000008D0000-0x00000000009CA000-memory.dmp

Filesize
1000KB

Download
memory/4124-0-0x000000007480E000-0x000000007480F000-memory.dmp

Filesize
4KB

Download
memory/4124-1084-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download
memory/4124-1085-0x000000007480E000-0x000000007480F000-memory.dmp

Filesize
4KB

Download
memory/4124-1086-0x0000000006030000-0x00000000065D4000-memory.dmp

Filesize
5.6MB

Download
memory/4124-1087-0x0000000005720000-0x0000000005774000-memory.dmp

Filesize
336KB

Download
memory/4124-1093-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download