Analysis
- max time kernel
101s - max time network
145s - platform
windows10_x64 - resource
win10 - submitted
29/07/2020, 06:45
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Invoice 09.PDF.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target Proforma Invoice 09.PDF.exe
- Size 243KB
- Sample200729-9e2wae93v2
- SHA256 9ba6343e794c0e415adb118885c33aa18446c746dd30ec59b4fda2724b2f08d7
- MD5 723f32a52c1aa09334b96647b4fb6beb
- SHA1 fb016666d6963e136f241908efed90b56e57b082
- SHA512 588038cbe644b9c720d776e83b66b0b92a6141c2ed69416ae71efff8cd9f0fe327c531f199e059d5790aeedaccf895efa1ab579392c40c6526c59c4e2e30906f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Async RAT payload 2 IoCs
resource yara_rule behavioral2/memory/4072-0-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/4072-1-0x000000000040DD6E-mapping.dmp asyncrat - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3104 set thread context of 4072 3104 Proforma Invoice 09.PDF.exe 68 - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe 3104 Proforma Invoice 09.PDF.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3104 Proforma Invoice 09.PDF.exe Token: SeDebugPrivilege 4072 Proforma Invoice 09.PDF.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3104 wrote to memory of 4028 3104 Proforma Invoice 09.PDF.exe 67 PID 3104 wrote to memory of 4028 3104 Proforma Invoice 09.PDF.exe 67 PID 3104 wrote to memory of 4028 3104 Proforma Invoice 09.PDF.exe 67 PID 3104 wrote to memory of 4072 3104 Proforma Invoice 09.PDF.exe 68 PID 3104 wrote to memory of 4072 3104 Proforma Invoice 09.PDF.exe 68 PID 3104 wrote to memory of 4072 3104 Proforma Invoice 09.PDF.exe 68 PID 3104 wrote to memory of 4072 3104 Proforma Invoice 09.PDF.exe 68 PID 3104 wrote to memory of 4072 3104 Proforma Invoice 09.PDF.exe 68 PID 3104 wrote to memory of 4072 3104 Proforma Invoice 09.PDF.exe 68 PID 3104 wrote to memory of 4072 3104 Proforma Invoice 09.PDF.exe 68 PID 3104 wrote to memory of 4072 3104 Proforma Invoice 09.PDF.exe 68
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proforma Invoice 09.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice 09.PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\Proforma Invoice 09.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice 09.PDF.exe"2⤵PID:4028
-
-
C:\Users\Admin\AppData\Local\Temp\Proforma Invoice 09.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice 09.PDF.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4072
-