| File name: | 093ed666582935d5b1169c0f512fd4194572b1dc0147d8ccf2a6d90893db23bb |
| Full analysis: | https://app.any.run/tasks/6ff6000f-2736-40ce-b57c-f4c013cf23ac |
| Verdict: | Malicious activity |
| Threats: | First identified in March 2021, PureCrypter is a .NET-based loader that employs obfuscation techniques, such as SmartAssembly, to evade detection. It has been used to distribute malware families including AgentTesla, RedLine Stealer, and SnakeKeylogger. The malware is typically delivered through phishing campaigns and malicious downloads, often masquerading as legitimate files with extensions like .mp4 or .pdf. PureCrypter utilizes encryption and compression to conceal its payloads and can inject malicious code into legitimate processes to maintain persistence on the infected system. |
| Analysis date: | May 17, 2025, 12:06:58 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 002D33FF0139EB77DBB572C874A3DCBD |
| SHA1: | 9F3211F20BE4398C205D7B14AF98120B0BB08FE6 |
| SHA256: | 093ED666582935D5B1169C0F512FD4194572B1DC0147D8CCF2A6D90893DB23BB |
| SSDEEP: | 24576:g5lgdMag5kNuWe2SZVUJzwDDStF0lbH/e:gngdMD5kNuWe2SZVUJzwDDStF0lbH/e |
MALICIOUS
PURECRYPTER has been detected (YARA)
- 093ed666582935d5b1169c0f512fd4194572b1dc0147d8ccf2a6d90893db23bb.exe (PID: 7428)
Steals credentials from Web Browsers
- aspnet_compiler.exe (PID: 7396)
Actions looks like stealing of personal data
- aspnet_compiler.exe (PID: 7396)
SUSPICIOUS
Reads security settings of Internet Explorer
- 093ed666582935d5b1169c0f512fd4194572b1dc0147d8ccf2a6d90893db23bb.exe (PID: 7428)
Starts CMD.EXE for commands execution
- 093ed666582935d5b1169c0f512fd4194572b1dc0147d8ccf2a6d90893db23bb.exe (PID: 7428)
Process uses IPCONFIG to discard the IP address configuration
- cmd.exe (PID: 7496)
Process uses IPCONFIG to renew DHCP configuration
- cmd.exe (PID: 7328)
Connects to SMTP port
- aspnet_compiler.exe (PID: 7396)
INFO
Reads the machine GUID from the registry
- 093ed666582935d5b1169c0f512fd4194572b1dc0147d8ccf2a6d90893db23bb.exe (PID: 7428)
- aspnet_compiler.exe (PID: 7396)
Reads the computer name
- 093ed666582935d5b1169c0f512fd4194572b1dc0147d8ccf2a6d90893db23bb.exe (PID: 7428)
- aspnet_compiler.exe (PID: 7396)
Process checks computer location settings
- 093ed666582935d5b1169c0f512fd4194572b1dc0147d8ccf2a6d90893db23bb.exe (PID: 7428)
Checks supported languages
- 093ed666582935d5b1169c0f512fd4194572b1dc0147d8ccf2a6d90893db23bb.exe (PID: 7428)
- aspnet_compiler.exe (PID: 7396)
Reads the software policy settings
- aspnet_compiler.exe (PID: 7396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:10:03 11:21:42+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 8 |
| CodeSize: | 644608 |
| InitializedDataSize: | 335360 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x9f59e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.25.0.0 |
| ProductVersionNumber: | 0.25.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | IPFS Native Application |
| CompanyName: | Protocol Labs, Inc. |
| FileDescription: | IPFS Native Application |
| FileVersion: | 0.25.0.0 |
| InternalName: | Jhfjryfzjjv.exe |
| LegalCopyright: | Copyright © 2022 Protocol Labs, Inc. |
| LegalTrademarks: | - |
| OriginalFileName: | Jhfjryfzjjv.exe |
| ProductName: | IPFS Desktop |
| ProductVersion: | 0.25.0.0 |
| AssemblyVersion: | 0.25.0.0 |
Total processes
137
Monitored processes
10
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 7148 | ipconfig /renew | C:\Windows\SysWOW64\ipconfig.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: IP Configuration Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7328 | "C:\Windows\System32\cmd.exe" /c ipconfig /renew | C:\Windows\SysWOW64\cmd.exe | — | 093ed666582935d5b1169c0f512fd4194572b1dc0147d8ccf2a6d90893db23bb.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7332 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7396 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe | 093ed666582935d5b1169c0f512fd4194572b1dc0147d8ccf2a6d90893db23bb.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: aspnet_compiler.exe Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 7428 | "C:\Users\admin\AppData\Local\Temp\093ed666582935d5b1169c0f512fd4194572b1dc0147d8ccf2a6d90893db23bb.exe" | C:\Users\admin\AppData\Local\Temp\093ed666582935d5b1169c0f512fd4194572b1dc0147d8ccf2a6d90893db23bb.exe | explorer.exe | ||||||||||||
User: admin Company: Protocol Labs, Inc. Integrity Level: MEDIUM Description: IPFS Native Application Exit code: 0 Version: 0.25.0.0 Modules
| |||||||||||||||
| 7496 | "C:\Windows\System32\cmd.exe" /c ipconfig /release | C:\Windows\SysWOW64\cmd.exe | — | 093ed666582935d5b1169c0f512fd4194572b1dc0147d8ccf2a6d90893db23bb.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7504 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7560 | ipconfig /release | C:\Windows\SysWOW64\ipconfig.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: IP Configuration Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7640 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7672 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | — | SppExtComObj.Exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
1 570
Read events
1 570
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
20
DNS requests
14
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.177:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
8184 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8184 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 23.48.23.177:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 40.126.32.74:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
smtp.yandex.com |
| whitelisted |