21e5114a7f07c582b74a78a0e3cf75ac751f4b3adeb609bda84d5755a6b5c2d2

Analysis

Target
PURCHASE ORDER.exe
Size 948KB
Sample201006-mk2rbd46q2
SHA256 21e5114a7f07c582b74a78a0e3cf75ac751f4b3adeb609bda84d5755a6b5c2d2
MD5 fa33ab41d8334ca25efdb48fe102a14c
SHA1 28326df42e3b0922b2c3133c4cf35488e410301a
SHA512 d9ae4bbf9c8607dd89d84a6fd7d1bbef6ba7530dffffc2053c1ecd8d25d2b401de678e633d7fc5d0c1bca5c24e0c61e54b6ed5f2c9371ce676d393759810ea3e
MD5 SHA1 SHA512

Score

9^/10

ServiceHost packer 5 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/2416-7-0x000000000043764E-mapping.dmp	servicehost
behavioral2/memory/2416-8-0x000000000043764E-mapping.dmp	servicehost
behavioral2/memory/2416-9-0x000000000043764E-mapping.dmp	servicehost
behavioral2/memory/2416-10-0x000000000043764E-mapping.dmp	servicehost
behavioral2/memory/2416-11-0x000000000043764E-mapping.dmp	servicehost

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3996 set thread context of 2416	3996	PURCHASE ORDER.exe	75

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2804	dw20.exe
2804	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2804	dw20.exe
Token: SeBackupPrivilege	2804	dw20.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 2416	3996	PURCHASE ORDER.exe	75
PID 3996 wrote to memory of 2416	3996	PURCHASE ORDER.exe	75
PID 3996 wrote to memory of 2416	3996	PURCHASE ORDER.exe	75
PID 3996 wrote to memory of 2416	3996	PURCHASE ORDER.exe	75
PID 3996 wrote to memory of 2416	3996	PURCHASE ORDER.exe	75
PID 3996 wrote to memory of 2416	3996	PURCHASE ORDER.exe	75
PID 3996 wrote to memory of 2416	3996	PURCHASE ORDER.exe	75
PID 3996 wrote to memory of 2416	3996	PURCHASE ORDER.exe	75
PID 2416 wrote to memory of 2804	2416	RegSvcs.exe	76
PID 2416 wrote to memory of 2804	2416	RegSvcs.exe	76
PID 2416 wrote to memory of 2804	2416	RegSvcs.exe	76

memory/2416-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2804-3-0x00000000025A0000-0x00000000025A1000-memory.dmp

Download

memory/2804-4-0x0000000002A00000-0x0000000002A01000-memory.dmp

Download

memory/2804-5-0x0000000002A00000-0x0000000002A01000-memory.dmp

Download

memory/2804-12-0x0000000002E50000-0x0000000002E51000-memory.dmp

Download