Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22-08-2024 22:35

General

  • Target

    64b58794801f282e92571676e3571afc5c59033c262406bf0d36e1d6ef3cda6a.exe

  • Size

    924KB

  • MD5

    de64bb0f39113e48a8499d3401461cf8

  • SHA1

    8d78c2d4701e4596e87e3f09adde214a2a2033e8

  • SHA256

    64b58794801f282e92571676e3571afc5c59033c262406bf0d36e1d6ef3cda6a

  • SHA512

    35b7cdcfb866dcdc79be34066a9ad5a8058b80e68925aeb23708606149841022de17e9d205389c13803c01e356174a2f657773df7d53f889e4e1fc1d68074179

  • SSDEEP

    24576:NAHFp2K15zXnjfQb6+jFb5RIAJTOcA4gnPdCPPd7wm:WHf15zM5JbtA4wPdCnd75

Malware Config

Signatures

  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

  • PureLog Stealer payload 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\64b58794801f282e92571676e3571afc5c59033c262406bf0d36e1d6ef3cda6a.exe
    "C:\Users\Admin\AppData\Local\Temp\64b58794801f282e92571676e3571afc5c59033c262406bf0d36e1d6ef3cda6a.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 624
      2⤵
      • Program crash
      PID:5976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2960-0-0x00000000744FE000-0x00000000744FF000-memory.dmp

    Filesize

    4KB

  • memory/2960-1-0x0000000000B00000-0x0000000000BEE000-memory.dmp

    Filesize

    952KB

  • memory/2960-2-0x00000000744F0000-0x0000000074BDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2960-3-0x0000000004300000-0x00000000043DC000-memory.dmp

    Filesize

    880KB

  • memory/2960-4-0x0000000004500000-0x00000000045DE000-memory.dmp

    Filesize

    888KB

  • memory/2960-10-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-5-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-8-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-14-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-12-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-16-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-20-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-24-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-22-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-18-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-6-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-28-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-46-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-26-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-30-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-34-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-68-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-66-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-64-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-62-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-60-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-58-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-56-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-54-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-52-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-50-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-48-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-1077-0x00000000744F0000-0x0000000074BDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2960-44-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-42-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-40-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-38-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-36-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-1078-0x0000000001FF0000-0x0000000002048000-memory.dmp

    Filesize

    352KB

  • memory/2960-1079-0x00000000020A0000-0x00000000020EC000-memory.dmp

    Filesize

    304KB

  • memory/2960-32-0x0000000004500000-0x00000000045D8000-memory.dmp

    Filesize

    864KB

  • memory/2960-1080-0x00000000744FE000-0x00000000744FF000-memory.dmp

    Filesize

    4KB

  • memory/2960-1081-0x00000000744F0000-0x0000000074BDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2960-1082-0x0000000002160000-0x00000000021B4000-memory.dmp

    Filesize

    336KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.