purelogstealer | 7a85ba084aff19a5ec83585bfd53a03f3d3214c1978f8058e4d6dc57f5b1546e

Analysis

max time kernel
130s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 13:36

Target

MTQ_0612065_016.exe
Size

332KB
MD5

1e000d97122cd44f3805592902e505ae
SHA1

94003b97739d0d4f2776361f82dc3e9a3f744ee6
SHA256

7a85ba084aff19a5ec83585bfd53a03f3d3214c1978f8058e4d6dc57f5b1546e
SHA512

484acfd728b8609b8c1a64c1772f5530d5cca99b3f4f8b1365a36d096b8ebac9977b2577656ff64489435ec6635491a796c26a281a4ca6f9bf92d420fc25f7ad
SSDEEP

6144:s1LUaHsGL8UYss61pZnFUw0s32WzNprLespyzUsMf0f:sKafGezNprrf0f

Score

10^/10

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer
PureLog Stealer payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2180-1-0x00000000003B0000-0x000000000040A000-memory.dmp family_purelog_stealer
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MTQ_0612065_016.exe

description pid process

Token: SeDebugPrivilege 2180 MTQ_0612065_016.exe

resource	yara_rule
behavioral1/memory/2180-1-0x00000000003B0000-0x000000000040A000-memory.dmp	family_purelog_stealer

description	pid	process
Token: SeDebugPrivilege	2180	MTQ_0612065_016.exe

C:\Users\Admin\AppData\Local\Temp\MTQ_0612065_016.exe
"C:\Users\Admin\AppData\Local\Temp\MTQ_0612065_016.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180

memory/2180-0-0x00000000743EE000-0x00000000743EF000-memory.dmp

Filesize
4KB

Download
memory/2180-1-0x00000000003B0000-0x000000000040A000-memory.dmp

Filesize
360KB

Download
memory/2180-2-0x0000000000210000-0x000000000021A000-memory.dmp

Filesize
40KB

Download
memory/2180-3-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/2180-4-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download