purelogstealer | 0d5a41ba3c0c0348e01eadb865c67021f1451f7013a8a695a03336b672ce02a5

Analysis

max time kernel
129s
max time network
139s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 08:54

Target

test2.exe
Size

312KB
MD5

86d3ab40b8ef928debf74c175f4f8c59
SHA1

1c131b65fb829b691b88cacd4ac071b5cfd11a26
SHA256

0d5a41ba3c0c0348e01eadb865c67021f1451f7013a8a695a03336b672ce02a5
SHA512

d4d193eb7d98a41b4cd6ce335faba38c69581895d4cbc5f06616459b7a445e90ebab5e6b5d80b92ffccedef828923dfa5e19e0c653862d75caae65cd65c0a89f
SSDEEP

3072:9y7ndTd5OnHkUqM3VPFK1jl6QQw7uI4otFC8Bsj:9yxTdYrhbXA6onA

Score

10^/10

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer
PureLog Stealer payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2464-1-0x00000000002B0000-0x0000000000300000-memory.dmp family_purelog_stealer
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

test2.exe

description pid process

Token: SeDebugPrivilege 2464 test2.exe

resource	yara_rule
behavioral1/memory/2464-1-0x00000000002B0000-0x0000000000300000-memory.dmp	family_purelog_stealer

description	pid	process
Token: SeDebugPrivilege	2464	test2.exe

C:\Users\Admin\AppData\Local\Temp\test2.exe
"C:\Users\Admin\AppData\Local\Temp\test2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2464

memory/2464-0-0x000000007496E000-0x000000007496F000-memory.dmp

Filesize
4KB

Download
memory/2464-1-0x00000000002B0000-0x0000000000300000-memory.dmp

Filesize
320KB

Download
memory/2464-2-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2464-3-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2464-4-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2464-5-0x000000007496E000-0x000000007496F000-memory.dmp

Filesize
4KB

Download
memory/2464-6-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download