c8741ad3130b95d1df602e99ed65489df788819dabe8907f2a449197e8ba97ef

Analysis

Target
PO_1012000007.exe
Size 634KB
Sample201012-d2qnd246fj
SHA256 c8741ad3130b95d1df602e99ed65489df788819dabe8907f2a449197e8ba97ef
MD5 6190282afdf5d0935f58381bd4d1bdf0
SHA1 505cea96f52313834d4558265b240ae1cfa97f21
SHA512 5d6bc81a90612377a7f88dd7f08a60265a43112184f14534d4fdbf0df7a46f4a57f2777a136c0dad1fbfafbb066b46ae3d97f2fd3f14411a6df80f6f1e313446
MD5 SHA1 SHA512

Score

9^/10

ServiceHost packer 5 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/1456-6-0x000000000043727E-mapping.dmp	servicehost
behavioral2/memory/1456-7-0x000000000043727E-mapping.dmp	servicehost
behavioral2/memory/1456-8-0x000000000043727E-mapping.dmp	servicehost
behavioral2/memory/1456-9-0x000000000043727E-mapping.dmp	servicehost
behavioral2/memory/1456-10-0x000000000043727E-mapping.dmp	servicehost

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3608 set thread context of 1456	3608	PO_1012000007.exe	77

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 1464	3608	PO_1012000007.exe	76
PID 3608 wrote to memory of 1464	3608	PO_1012000007.exe	76
PID 3608 wrote to memory of 1464	3608	PO_1012000007.exe	76
PID 3608 wrote to memory of 1456	3608	PO_1012000007.exe	77
PID 3608 wrote to memory of 1456	3608	PO_1012000007.exe	77
PID 3608 wrote to memory of 1456	3608	PO_1012000007.exe	77
PID 3608 wrote to memory of 1456	3608	PO_1012000007.exe	77
PID 3608 wrote to memory of 1456	3608	PO_1012000007.exe	77
PID 3608 wrote to memory of 1456	3608	PO_1012000007.exe	77
PID 3608 wrote to memory of 1456	3608	PO_1012000007.exe	77
PID 3608 wrote to memory of 1456	3608	PO_1012000007.exe	77
PID 1456 wrote to memory of 1792	1456	PO_1012000007.exe	78
PID 1456 wrote to memory of 1792	1456	PO_1012000007.exe	78
PID 1456 wrote to memory of 1792	1456	PO_1012000007.exe	78

C:\Users\Admin\AppData\Local\Temp\PO_1012000007.exe
"C:\Users\Admin\AppData\Local\Temp\PO_1012000007.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Users\Admin\AppData\Local\Temp\PO_1012000007.exe
  "C:\Users\Admin\AppData\Local\Temp\PO_1012000007.exe"
  2⤵
  PID:1464
- C:\Users\Admin\AppData\Local\Temp\PO_1012000007.exe
  "C:\Users\Admin\AppData\Local\Temp\PO_1012000007.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 708
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1792

memory/1456-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1792-4-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/1792-5-0x0000000002A40000-0x0000000002A41000-memory.dmp

Download

memory/1792-11-0x0000000002E60000-0x0000000002E61000-memory.dmp

Download