Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
24-12-2024 02:39
General
-
Target
8dbe87dfd43e58019a522dfc28c6cdcdbdeb646bef58ce4e725e3b726e06c607.exe
-
Size
15KB
-
MD5
05613c738677507878978d420976eeb7
-
SHA1
f37a8f72705009328ee0ac04e77e26f985822106
-
SHA256
8dbe87dfd43e58019a522dfc28c6cdcdbdeb646bef58ce4e725e3b726e06c607
-
SHA512
b36c35116704ef7eb49e9acc212f218188786e964b4a88530dc9935a86071f1d9d66dc1181faadd017e4b04808f2afbbbd7449b2cddeab9d9eb784fb4571cd9b
-
SSDEEP
384:AQqLaF7XUehAHdoyw2AKIYldyvaynNxLEwRfnwalylww3mPAwgwInXCYyAQvlwtS:32a+eKrADRzQwRn2YN9dz+mw2liVIU
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://iriseagle.com/img/loader/uploads/Cakaenu.bmp
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Purecrypter family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dbe87dfd43e58019a522dfc28c6cdcdbdeb646bef58ce4e725e3b726e06c607.exe"C:\Users\Admin\AppData\Local\Temp\8dbe87dfd43e58019a522dfc28c6cdcdbdeb646bef58ce4e725e3b726e06c607.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
6.9MB
-
Filesize
6.9MB