Analysis
- max time kernel
96s - max time network
142s - platform
windows7_x64 - resource
win7v200722 - submitted
29/07/2020, 06:45
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Invoice 09.PDF.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target Proforma Invoice 09.PDF.exe
- Size 243KB
- Sample200729-9e2wae93v2
- SHA256 9ba6343e794c0e415adb118885c33aa18446c746dd30ec59b4fda2724b2f08d7
- MD5 723f32a52c1aa09334b96647b4fb6beb
- SHA1 fb016666d6963e136f241908efed90b56e57b082
- SHA512 588038cbe644b9c720d776e83b66b0b92a6141c2ed69416ae71efff8cd9f0fe327c531f199e059d5790aeedaccf895efa1ab579392c40c6526c59c4e2e30906f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Async RAT payload 4 IoCs
resource yara_rule behavioral1/memory/1512-0-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1512-1-0x000000000040DD6E-mapping.dmp asyncrat behavioral1/memory/1512-2-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1512-3-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 388 set thread context of 1512 388 Proforma Invoice 09.PDF.exe 24 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe 388 Proforma Invoice 09.PDF.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 388 Proforma Invoice 09.PDF.exe Token: SeDebugPrivilege 1512 Proforma Invoice 09.PDF.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 388 wrote to memory of 1512 388 Proforma Invoice 09.PDF.exe 24 PID 388 wrote to memory of 1512 388 Proforma Invoice 09.PDF.exe 24 PID 388 wrote to memory of 1512 388 Proforma Invoice 09.PDF.exe 24 PID 388 wrote to memory of 1512 388 Proforma Invoice 09.PDF.exe 24 PID 388 wrote to memory of 1512 388 Proforma Invoice 09.PDF.exe 24 PID 388 wrote to memory of 1512 388 Proforma Invoice 09.PDF.exe 24 PID 388 wrote to memory of 1512 388 Proforma Invoice 09.PDF.exe 24 PID 388 wrote to memory of 1512 388 Proforma Invoice 09.PDF.exe 24 PID 388 wrote to memory of 1512 388 Proforma Invoice 09.PDF.exe 24
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proforma Invoice 09.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice 09.PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\Proforma Invoice 09.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice 09.PDF.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512
-