PureRAT + PureLogs Infostealer Campaign Hits Japanese Enterprises: OTX Pulse Analysis — Phishing-to-Process-Hollowing Detection Pack

---
title: PureRAT/PureLogs - Double Extension Executable Execution From Archive
id: 8f3a2c1e-7d4b-4e9a-b2f1-purerat00001
status: experimental
description: Detects execution of files with double extensions (e.g., .pdf.exe) launched from ZIP extraction paths, consistent with the PureRAT/PureLogs phishing campaign targeting Japanese organizations.
author: Security Arsenal Threat Intelligence
references:
  - https://otx.alienvault.com/pulse/purerat-purelogs-japan
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\Downloads\'
      - '\AppData\Local\Microsoft\Windows\INetCache\'
  selection_ext:
    Image|endswith:
      - '.pdf.exe'
      - '.doc.exe'
      - '.docx.exe'
      - '.xlsx.exe'
      - '.jpg.exe'
  condition: selection_path and selection_ext
falsepositives:
  - Rare; some legacy installers use compound extensions
level: high
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.t1204.002
date: 2026/10/25
---
title: PureRAT - Process Hollowing Via Suspended Process Injection
id: 8f3a2c1e-7d4b-4e9a-b2f1-purerat00002
status: experimental
description: Detects process creation in suspended state followed by remote thread/memory write activity characteristic of process hollowing used by PureRAT and Donut loader payloads.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith:
      - '\svchost.exe'
      - '\explorer.exe'
      - '\notepad.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
    GrantedAccess|contains:
      - '0x1FFFFF'
      - '0x1F3FFF'
  filter_legit:
    SourceImage|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Program Files\Microsoft\'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate debugging tools, some EDR agents
level: high
tags:
  - attack.defense_evasion
  - attack.t1055.012
date: 2026/10/25
---
title: PureLogs - Credential Store Access By Non-Browser Process
id: 8f3a2c1e-7d4b-4e9a-b2f1-purerat00003
status: experimental
description: Detects unauthorized access to browser credential stores (Chrome Login Data, Edge, Firefox logins.json) by non-browser processes, consistent with PureLogs infostealer collection behavior.
author: Security Arsenal Threat Intelligence
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFileName|contains:
      - '\Google\Chrome\User Data\Default\Login Data'
      - '\Google\Chrome\User Data\Local State'
      - '\Microsoft\Edge\User Data\Default\Login Data'
      - '\Mozilla\Firefox\Profiles\'
      - 'logins.json'
      - 'key4.db'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  condition: selection and not filter_browsers
falsepositives:
  - Password managers, backup agents, forensic tools
level: critical
tags:
  - attack.credential_access
  - attack.t1555.003
date: 2026/10/25

// Security Arsenal — PureRAT/PureLogs Campaign Hunt (Microsoft Sentinel)
// Hunts for known C2/staging domains and hollowed-process network beacons over the past 30 days
let PureDomains = dynamic(["baoquocgiavn.com","bayareakajabe.com","bartonaussies.com","tirakian.com","shareddocumentdrivehub.com"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl in~ (PureDomains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
let HollowedBeacons = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("svchost.exe","notepad.exe","rundll32.exe","regsvr32.exe","explorer.exe")
| where RemotePort in (80, 443, 8080, 8443)
| where not(RemoteUrl endswith "microsoft.com" or RemoteUrl endswith "windows.com" or RemoteUrl endswith "office.com" or isempty(RemoteUrl))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, RemoteUrl, RemoteIP;
let DoubleExtExec = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName matches regex @"\.(pdf|docx?|xlsx?|jpg|png)\.exe$"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, SHA256;
union NetworkHits, HollowedBeacons, DoubleExtExec
| sort by TimeGenerated desc

# Security Arsenal — PureRAT/PureLogs IOC & Artifact Hunt (PowerShell)
# Run elevated on suspected endpoints or deploy fleet-wide via RMM/SCCM

$PureDomains = @("baoquocgiavn.com","bayareakajabe.com","bartonaussies.com","tirakian.com","shareddocumentdrivehub.com")
$PureHashes  = @("5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946","87903559afa09a0dfe251598c14e58124bddde1d","82699276b0f59a2304120a6baaf64a6b")
$Report = @()

# 1. DNS cache check for C2/staging domain resolution
Write-Host "[*] Checking DNS cache for PureRAT/PureLogs domains..." -ForegroundColor Cyan
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $d = $_.Name; $PureDomains | Where-Object { $d -like "*$_*" } }
if ($dns) { $Report += [pscustomobject]@{Type="DNSCache"; Detail=($dns | Out-String)} }

# 2. Registry Run key persistence check
Write-Host "[*] Checking Run keys for suspicious persistence..." -ForegroundColor Cyan
$RunPaths = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce")
foreach ($p in $RunPaths) {
    Get-ItemProperty $p -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match '\.(pdf|docx?|xlsx?)\.exe|Temp\\|AppData\\Local\\Temp' } | ForEach-Object {
            $Report += [pscustomobject]@{Type="RunKey"; Detail="$p :: $($_.Name) = $($_.Value)"}
        }
    }
}

# 3. Double-extension executables in staging directories
Write-Host "[*] Scanning Downloads/Temp for double-extension executables..." -ForegroundColor Cyan
$ScanDirs = @("$env:USERPROFILE\Downloads","$env:TEMP","C:\Users\Public\Downloads")
foreach ($dir in $ScanDirs) {
    Get-ChildItem $dir -Recurse -ErrorAction SilentlyContinue -Include *.pdf.exe,*.doc.exe,*.docx.exe,*.xlsx.exe,*.jpg.exe | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        $known = if ($PureHashes -contains $h) {" [KNOWN PURE IOCS]"} else {""}
        $Report += [pscustomobject]@{Type="DoubleExtFile"; Detail="$($_.FullName) SHA256=$h$known"}
    }
}

# 4. Scheduled tasks referencing temp/user-profile binaries
Write-Host "[*] Checking scheduled tasks for loader persistence..." -ForegroundColor Cyan
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $actions = $_.Actions | Out-String
    if ($actions -match 'Temp\\|AppData\\|\.pdf\.exe') {
        $Report += [pscustomobject]@{Type="ScheduledTask"; Detail="$($_.TaskName): $actions"}
    }
}

# 5. Active network connections from commonly hollowed processes
Write-Host "[*] Checking for suspicious outbound connections from hollow-process candidates..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc.ProcessName -match '^(notepad|svchost|rundll32|regsvr32)$' -and $_.RemotePort -in 443,8080,8443,80) {
        if ($proc.Path -notlike "C:\Windows\System32\svchost.exe") {
            $Report += [pscustomobject]@{Type="NetConnection"; Detail="$($proc.ProcessName) (PID $($proc.Id)) -> $($_.RemoteAddress):$($_.RemotePort) Path=$($proc.Path)"}
        }
    }
}

Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Yellow
if ($Report.Count -gt 0) { $Report | Format-List; $Report | Export-Csv "PureRAT_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation }
else { Write-Host "No PureRAT/PureLogs artifacts detected." -ForegroundColor Green }