Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-01-2025 03:55
General
-
Target
bf6aabd3c8fc42049fc6435f2432c97a8e8aa3258e0591b3756d5d84df2b3e6c.exe
-
Size
12KB
-
MD5
d165a97582770739cc7b847e1b5dbeef
-
SHA1
fa06c1014fa0810e3ea2cbc661e9bb443461ad9e
-
SHA256
bf6aabd3c8fc42049fc6435f2432c97a8e8aa3258e0591b3756d5d84df2b3e6c
-
SHA512
2e4f226bf38340ea356c6003549bccfca562247375475b82e92ba97d9f7969fc795e2a3134dbcb0aecec2bc3df48785552995ce4714aff627fc101caa379f9dc
-
SSDEEP
192:aQx1U46h8FHN3t4Ag/MkpAfQZz/IJ5ev:/y8FHNmZMkpAIZz/ILe
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://www.vascocorretora.com.br/PPI/Lhysknv.dat
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Purecrypter family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf6aabd3c8fc42049fc6435f2432c97a8e8aa3258e0591b3756d5d84df2b3e6c.exe"C:\Users\Admin\AppData\Local\Temp\bf6aabd3c8fc42049fc6435f2432c97a8e8aa3258e0591b3756d5d84df2b3e6c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB