purelogstealer | 81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa

Analysis

max time kernel
132s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
Size

976KB
MD5

902f14b6f32cc40a82d6a0f2c41208ec
SHA1

c01e5bc3e9dbb84a5b36841045055999fc0a16cf
SHA256

81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa
SHA512

d55e184309e122ffbe3097bfb64b3e23829228cd16030dca5856bfa1725bc60c2da04bf04c8919ca658ca4b7b03e4be6e6bc9240b5816903609969213be2f97c
SSDEEP

24576:1Ibj07xMVrpydHnnDfiDw8PZIykCu3oxmv2GX:1+ukYxDqnZTlns2

Score

10^/10

purelogstealer discovery persistence stealer

Malware Config

Signatures

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/428-1-0x0000000000560000-0x000000000065A000-memory.dmp	family_purelog_stealer
C:\ProgramData\vqml\jmhe.exe	family_purelog_stealer

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

Processes:

81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exejmhe.exejmhe.exe

description	pid	process	target process
PID 428 created 3512	428	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe	Explorer.EXE
PID 860 created 3512	860	jmhe.exe	Explorer.EXE
PID 4928 created 3512	4928	jmhe.exe	Explorer.EXE

Executes dropped EXE 4 IoCs

Processes:

jmhe.exejmhe.exejmhe.exejmhe.exe

pid process

860 jmhe.exe
4324 jmhe.exe
4928 jmhe.exe
3312 jmhe.exe

pid	process
860	jmhe.exe
4324	jmhe.exe
4928	jmhe.exe
3312	jmhe.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\afasdfga = "C:\\Users\\Admin\\AppData\\Roaming\\afasdfga.exe"	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exejmhe.exejmhe.exe

description	pid	process	target process
PID 428 set thread context of 3360	428	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
PID 860 set thread context of 4324	860	jmhe.exe	jmhe.exe
PID 4928 set thread context of 3312	4928	jmhe.exe	jmhe.exe

Drops file in Windows directory 1 IoCs

Processes:

81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe

description ioc process

File created C:\Windows\Tasks\Test Task17.job 81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe

description	ioc	process
File created	C:\Windows\Tasks\Test Task17.job	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exejmhe.exejmhe.exejmhe.exejmhe.exe81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exejmhe.exejmhe.exe

pid process

428 81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
860 jmhe.exe
4928 jmhe.exe

pid	process
428	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
860	jmhe.exe
4928	jmhe.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exejmhe.exejmhe.exe

description	pid	process
Token: SeDebugPrivilege	428	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
Token: SeDebugPrivilege	428	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
Token: SeDebugPrivilege	860	jmhe.exe
Token: SeDebugPrivilege	860	jmhe.exe
Token: SeDebugPrivilege	4928	jmhe.exe
Token: SeDebugPrivilege	4928	jmhe.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exejmhe.exejmhe.exe

description	pid	process	target process
PID 428 wrote to memory of 3360	428	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
PID 428 wrote to memory of 3360	428	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
PID 428 wrote to memory of 3360	428	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
PID 428 wrote to memory of 3360	428	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
PID 428 wrote to memory of 3360	428	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
PID 428 wrote to memory of 3360	428	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
PID 428 wrote to memory of 3360	428	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
PID 428 wrote to memory of 3360	428	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe	81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
PID 860 wrote to memory of 4324	860	jmhe.exe	jmhe.exe
PID 860 wrote to memory of 4324	860	jmhe.exe	jmhe.exe
PID 860 wrote to memory of 4324	860	jmhe.exe	jmhe.exe
PID 860 wrote to memory of 4324	860	jmhe.exe	jmhe.exe
PID 860 wrote to memory of 4324	860	jmhe.exe	jmhe.exe
PID 860 wrote to memory of 4324	860	jmhe.exe	jmhe.exe
PID 860 wrote to memory of 4324	860	jmhe.exe	jmhe.exe
PID 860 wrote to memory of 4324	860	jmhe.exe	jmhe.exe
PID 4928 wrote to memory of 3312	4928	jmhe.exe	jmhe.exe
PID 4928 wrote to memory of 3312	4928	jmhe.exe	jmhe.exe
PID 4928 wrote to memory of 3312	4928	jmhe.exe	jmhe.exe
PID 4928 wrote to memory of 3312	4928	jmhe.exe	jmhe.exe
PID 4928 wrote to memory of 3312	4928	jmhe.exe	jmhe.exe
PID 4928 wrote to memory of 3312	4928	jmhe.exe	jmhe.exe
PID 4928 wrote to memory of 3312	4928	jmhe.exe	jmhe.exe
PID 4928 wrote to memory of 3312	4928	jmhe.exe	jmhe.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3512
- C:\Users\Admin\AppData\Local\Temp\81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
  "C:\Users\Admin\AppData\Local\Temp\81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:428
- C:\Users\Admin\AppData\Local\Temp\81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe
  "C:\Users\Admin\AppData\Local\Temp\81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3360
- C:\ProgramData\vqml\jmhe.exe
  "C:\ProgramData\vqml\jmhe.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4324
- C:\ProgramData\vqml\jmhe.exe
  "C:\ProgramData\vqml\jmhe.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3312

C:\ProgramData\vqml\jmhe.exe
C:\ProgramData\vqml\jmhe.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860

C:\ProgramData\vqml\jmhe.exe
C:\ProgramData\vqml\jmhe.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vqml\jmhe.exe

Filesize
976KB

MD5
902f14b6f32cc40a82d6a0f2c41208ec

SHA1
c01e5bc3e9dbb84a5b36841045055999fc0a16cf

SHA256
81f91061c650c2d9fdeab6a9d8be220a93d46f930d5c435e4a00c511236a4caa

SHA512
d55e184309e122ffbe3097bfb64b3e23829228cd16030dca5856bfa1725bc60c2da04bf04c8919ca658ca4b7b03e4be6e6bc9240b5816903609969213be2f97c

Download Submit
C:\Windows\Tasks\Test Task17.job

Filesize
230B

MD5
7e78d304114b1a2dc9abf2ae860dd825

SHA1
1bfd050b2e653a0db037b6c663f27027e52dfc5a

SHA256
bd8b3740ae7a88cfa721e082ce9c312436a602f373864a27357e9af6bf3d7f3e

SHA512
7744af2c4e21cc3a30671ea110d1cda461e96a4d92ea1c984e7db0c1bdb76f2e0b15eaccaf352ed7dfd2de44fa2e063a7bea9fee197dec08db080e1eed859cb2

Download Submit
memory/428-0-0x00000000753AE000-0x00000000753AF000-memory.dmp

Filesize
4KB

Download
memory/428-1-0x0000000000560000-0x000000000065A000-memory.dmp

Filesize
1000KB

Download
memory/428-2-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/428-3-0x0000000004FA0000-0x000000000507C000-memory.dmp

Filesize
880KB

Download
memory/428-4-0x0000000005160000-0x000000000523C000-memory.dmp

Filesize
880KB

Download
memory/428-6-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-14-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-68-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-64-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-62-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-60-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-58-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-56-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-52-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-50-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-48-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-46-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-44-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-42-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-40-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-34-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-32-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-30-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-28-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-26-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-24-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-22-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-20-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-18-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-16-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-12-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-10-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-8-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-66-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-54-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-38-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-36-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-5-0x0000000005160000-0x0000000005236000-memory.dmp

Filesize
856KB

Download
memory/428-1077-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/428-1078-0x0000000005280000-0x00000000052D8000-memory.dmp

Filesize
352KB

Download
memory/428-1079-0x00000000052E0000-0x000000000532C000-memory.dmp

Filesize
304KB

Download
memory/428-1084-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/428-1083-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/428-1085-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/428-1086-0x00000000753AE000-0x00000000753AF000-memory.dmp

Filesize
4KB

Download
memory/428-1087-0x0000000005CC0000-0x0000000006264000-memory.dmp

Filesize
5.6MB

Download
memory/428-1088-0x00000000053B0000-0x0000000005404000-memory.dmp

Filesize
336KB

Download
memory/428-1096-0x00000000753A0000-0x0000000075B50000-memory.dmp

Filesize
7.7MB

Download
memory/860-1101-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/860-1100-0x0000000074D1E000-0x0000000074D1F000-memory.dmp

Filesize
4KB

Download
memory/860-2174-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/860-2178-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/860-2179-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/860-2180-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/860-2181-0x0000000074D1E000-0x0000000074D1F000-memory.dmp

Filesize
4KB

Download
memory/860-2182-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/860-2190-0x0000000074D10000-0x00000000754C0000-memory.dmp

Filesize
7.7MB

Download
memory/3360-1094-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4324-2189-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download