| File name: | Best Quote.com |
| Full analysis: | https://app.any.run/tasks/d9bf0192-6938-41b7-869b-4d2a4329c944 |
| Verdict: | Malicious activity |
| Threats: | First identified in March 2021, PureCrypter is a .NET-based loader that employs obfuscation techniques, such as SmartAssembly, to evade detection. It has been used to distribute malware families including AgentTesla, RedLine Stealer, and SnakeKeylogger. The malware is typically delivered through phishing campaigns and malicious downloads, often masquerading as legitimate files with extensions like .mp4 or .pdf. PureCrypter utilizes encryption and compression to conceal its payloads and can inject malicious code into legitimate processes to maintain persistence on the infected system. |
| Analysis date: | March 31, 2025, 12:27:59 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections |
| MD5: | DA8D16D22CC8FE82D382AAC00E91FFB1 |
| SHA1: | CF21EFE6703D133CF69601A5A3640DA287B11E25 |
| SHA256: | 13030ECC74107D74688CEF126821A6D89FC35C7FCBF8C037F257773B71E82278 |
| SSDEEP: | 49152:IlbaEi/Mb/PqkpcvATDobUPv6CBCyPzAqUQB6bu5QDfKFTH2O7LD4zQr4vroJSt7:IlbaEi/Mb/9pcITDqUvJ3bRUd0QDfyHU |
MALICIOUS
PURECRYPTER has been detected (YARA)
- Best Quote.com.exe (PID: 7568)
SUSPICIOUS
No suspicious indicators.INFO
Checks supported languages
- Best Quote.com.exe (PID: 7568)
Manual execution by a user
- Best Quote.com.exe (PID: 8028)
- Best Quote.com.exe (PID: 8052)
- Best Quote.com.exe (PID: 8040)
- Best Quote.com.exe (PID: 8064)
- Best Quote.com.exe (PID: 8076)
- Best Quote.com.exe (PID: 8088)
- Best Quote.com.exe (PID: 8112)
- Best Quote.com.exe (PID: 8100)
Reads the machine GUID from the registry
- Best Quote.com.exe (PID: 7568)
Reads Environment values
- Best Quote.com.exe (PID: 7568)
Reads the computer name
- Best Quote.com.exe (PID: 7568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic Win/DOS Executable (50) |
|---|---|---|
| .exe | | | DOS Executable Generic (49.9) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2025:03:31 09:35:29+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 8 |
| CodeSize: | 1277440 |
| InitializedDataSize: | 181760 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x0000 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | - |
| FileDescription: | Pkxuwzunxz |
| FileVersion: | 1.0.0.0 |
| InternalName: | Pkxuwzunxz.exe |
| LegalCopyright: | Copyright © 2024 |
| LegalTrademarks: | - |
| OriginalFileName: | Pkxuwzunxz.exe |
| ProductName: | Pkxuwzunxz |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
Total processes
137
Monitored processes
11
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 7568 | "C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe" | C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Pkxuwzunxz Exit code: 4294967295 Version: 1.0.0.0 Modules
| |||||||||||||||
| 7652 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7684 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | — | SppExtComObj.Exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 8028 | "C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe" | C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Pkxuwzunxz Exit code: 4294967295 Version: 1.0.0.0 Modules
| |||||||||||||||
| 8040 | "C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe" | C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Pkxuwzunxz Exit code: 4294967295 Version: 1.0.0.0 Modules
| |||||||||||||||
| 8052 | "C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe" | C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Pkxuwzunxz Exit code: 4294967295 Version: 1.0.0.0 Modules
| |||||||||||||||
| 8064 | "C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe" | C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Pkxuwzunxz Exit code: 4294967295 Version: 1.0.0.0 Modules
| |||||||||||||||
| 8076 | "C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe" | C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Pkxuwzunxz Exit code: 4294967295 Version: 1.0.0.0 Modules
| |||||||||||||||
| 8088 | "C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe" | C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Pkxuwzunxz Exit code: 4294967295 Version: 1.0.0.0 Modules
| |||||||||||||||
| 8100 | "C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe" | C:\Users\admin\AppData\Local\Temp\Best Quote.com.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Pkxuwzunxz Exit code: 4294967295 Version: 1.0.0.0 Modules
| |||||||||||||||
Total events
304
Read events
304
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
19
DNS requests
14
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4244 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4244 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.172.255.218:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6544 | svchost.exe | 40.126.31.1:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2112 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |