b0a79c8f4d2c3a1eecbc5efec65dab4179beb27452024ee2a54e99139c85c40a

General

Target
ZANTEX PURCHASE _PDF____________________________________________,,,.exe
Size 630KB
Sample200721-qtzvapy8kn
SHA256 b0a79c8f4d2c3a1eecbc5efec65dab4179beb27452024ee2a54e99139c85c40a
MD5 4ae9072d43439084ab7185ac5ec6324b
SHA1 05f132e72f610bb1b7aece2bee1e4b5cb390294c
SHA512 b0fabe50aab0d4a595e276820bac97fa12a722fb6eef38889056df6a94df64ec012df71ed359023b67939d20359131d71b8d0362579fb8a1d7d62f8971238668
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe
1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe
1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe
1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe
1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1828	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1828	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	26
PID 1388 wrote to memory of 1828	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	26
PID 1388 wrote to memory of 1828	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	26
PID 1388 wrote to memory of 1828	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	26
PID 1388 wrote to memory of 1856	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	28
PID 1388 wrote to memory of 1856	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	28
PID 1388 wrote to memory of 1856	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	28
PID 1388 wrote to memory of 1856	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	28
PID 1388 wrote to memory of 1876	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	29
PID 1388 wrote to memory of 1876	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	29
PID 1388 wrote to memory of 1876	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	29
PID 1388 wrote to memory of 1876	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	29
PID 1388 wrote to memory of 1872	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	30
PID 1388 wrote to memory of 1872	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	30
PID 1388 wrote to memory of 1872	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	30
PID 1388 wrote to memory of 1872	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	30
PID 1388 wrote to memory of 1780	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	31
PID 1388 wrote to memory of 1780	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	31
PID 1388 wrote to memory of 1780	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	31
PID 1388 wrote to memory of 1780	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	31
PID 1388 wrote to memory of 1776	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	32
PID 1388 wrote to memory of 1776	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	32
PID 1388 wrote to memory of 1776	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	32
PID 1388 wrote to memory of 1776	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe	32

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	ZANTEX PURCHASE _PDF____________________________________________,,,.exe

C:\Users\Admin\AppData\Local\Temp\ZANTEX PURCHASE _PDF____________________________________________,,,.exe
"C:\Users\Admin\AppData\Local\Temp\ZANTEX PURCHASE _PDF____________________________________________,,,.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1388
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DsBUZIz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBA3.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1828
- C:\Users\Admin\AppData\Local\Temp\ZANTEX PURCHASE _PDF____________________________________________,,,.exe
  "{path}"
  2⤵
  PID:1856
- C:\Users\Admin\AppData\Local\Temp\ZANTEX PURCHASE _PDF____________________________________________,,,.exe
  "{path}"
  2⤵
  PID:1876
- C:\Users\Admin\AppData\Local\Temp\ZANTEX PURCHASE _PDF____________________________________________,,,.exe
  "{path}"
  2⤵
  PID:1872
- C:\Users\Admin\AppData\Local\Temp\ZANTEX PURCHASE _PDF____________________________________________,,,.exe
  "{path}"
  2⤵
  PID:1780
- C:\Users\Admin\AppData\Local\Temp\ZANTEX PURCHASE _PDF____________________________________________,,,.exe
  "{path}"
  2⤵
  PID:1776