Analysis date (UTC): 3 March 2025, 08:07Analysis environment: Windows 10 Pro, build 19045, x64

731d2730d9fc8567a981d16fc2b693ab3e658220ea313a6b95694f2f4429ce01

MD5:8C476ABF24D958C8AF0F8330CCE9A949

SHA1:A949845D1DA4DA991B1B0AFFC1219AC2CA45E0CE

SHA256:731D2730D9FC8567A981D16FC2B693AB3E658220EA313A6B95694F2F4429CE01

Analysis result

Threat level:Malicious activity

Tags:

exfiltrationpurelogspurecrypterstealer

Full analysis:Analysis 731d2730d9fc8567a981d16fc2b693ab3e658220ea313a6b95694f2f4429ce01 (MD5: 8C476ABF24D958C8AF0F8330CCE9A949) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Scans artifacts that could help determine the target

InstallUtil.exe (PID: 5968)

Steals credentials from Web Browsers

InstallUtil.exe (PID: 5968)

Actions looks like stealing of personal data

InstallUtil.exe (PID: 5968)

PURELOGS has been detected (SURICATA)

InstallUtil.exe (PID: 5968)

SUSPICIOUS

Starts POWERSHELL.EXE for commands execution

731d2730d9fc8567a981d16fc2b693ab3e658220ea313a6b95694f2f4429ce01.exe (PID: 6872)
InstallUtil.exe (PID: 5968)

Reads security settings of Internet Explorer

731d2730d9fc8567a981d16fc2b693ab3e658220ea313a6b95694f2f4429ce01.exe (PID: 6872)

Starts process via Powershell

powershell.exe (PID: 3100)

Connects to unusual port

InstallUtil.exe (PID: 5968)

Removes files via Powershell

powershell.exe (PID: 7596)

PowerShell delay command usage (probably sleep evasion)

powershell.exe (PID: 7596)

INFO

Checks proxy server information

731d2730d9fc8567a981d16fc2b693ab3e658220ea313a6b95694f2f4429ce01.exe (PID: 6872)
slui.exe (PID: 2656)

Disables trace logs

731d2730d9fc8567a981d16fc2b693ab3e658220ea313a6b95694f2f4429ce01.exe (PID: 6872)

Reads the computer name

731d2730d9fc8567a981d16fc2b693ab3e658220ea313a6b95694f2f4429ce01.exe (PID: 6872)
InstallUtil.exe (PID: 5968)
identity_helper.exe (PID: 7936)

Reads the machine GUID from the registry

731d2730d9fc8567a981d16fc2b693ab3e658220ea313a6b95694f2f4429ce01.exe (PID: 6872)
InstallUtil.exe (PID: 5968)

Process checks computer location settings

731d2730d9fc8567a981d16fc2b693ab3e658220ea313a6b95694f2f4429ce01.exe (PID: 6872)

Checks supported languages

InstallUtil.exe (PID: 5968)
731d2730d9fc8567a981d16fc2b693ab3e658220ea313a6b95694f2f4429ce01.exe (PID: 6872)
identity_helper.exe (PID: 7936)

Application launched itself

msedge.exe (PID: 1812)

Reads the software policy settings

731d2730d9fc8567a981d16fc2b693ab3e658220ea313a6b95694f2f4429ce01.exe (PID: 6872)
slui.exe (PID: 2656)

Reads Microsoft Office registry keys

InstallUtil.exe (PID: 5968)

Manual execution by a user

InstallUtil.exe (PID: 5968)

Script raised an exception (POWERSHELL)

powershell.exe (PID: 7596)

Connects to unusual port

msedge.exe (PID: 1040)

Threats

PID	Process	Class	Message
5968	InstallUtil.exe	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 37
5968	InstallUtil.exe	A Network Trojan was detected	STEALER [ANY.RUN] PureLogs Stealer Exfiltration
—	—	Potentially Bad Traffic	ET INFO Possible Chrome Plugin install
1040	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] An application monitoring request to newrelic .com
1040	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] An application monitoring request to newrelic .com
1040	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] An application monitoring request to newrelic .com
1040	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] An application monitoring request to newrelic .com