d9ef6dd0ddbe95b3f858ec1e3cb40d5493c89f8844227f2c31739a9e7cef7ab9

General

Target
CNC 39200-pdf.exe
Size 676KB
Sample201014-dhfw6wsaqe
SHA256 d9ef6dd0ddbe95b3f858ec1e3cb40d5493c89f8844227f2c31739a9e7cef7ab9
MD5 63fd7ddf82fa470150fc1362112e0eb1
SHA1 74117a3e6345472e52c283dafb71647478988b87
SHA512 170a5d93cd92ec02776859573b9727ff428727b47e15d704c6a868b04977154c190e1adb19a19b2960c92ffddd7a8eab34834f9039c8b5f843241383f305c08c
MD5 SHA1 SHA512

Score

9^/10

Malware Config

Signatures

ServiceHost packer 14 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral1/memory/1880-18-0x000000000043784E-mapping.dmp	servicehost
behavioral1/memory/1880-17-0x000000000043784E-mapping.dmp	servicehost
behavioral1/memory/1880-20-0x000000000043784E-mapping.dmp	servicehost
behavioral1/memory/1880-19-0x000000000043784E-mapping.dmp	servicehost
behavioral1/memory/1880-22-0x000000000043784E-mapping.dmp	servicehost
behavioral1/memory/1880-21-0x000000000043784E-mapping.dmp	servicehost
behavioral1/memory/1880-23-0x000000000043784E-mapping.dmp	servicehost
behavioral1/memory/1880-24-0x000000000043784E-mapping.dmp	servicehost
behavioral1/memory/1880-25-0x000000000043784E-mapping.dmp	servicehost
behavioral1/memory/1880-26-0x000000000043784E-mapping.dmp	servicehost
behavioral1/memory/1880-27-0x000000000043784E-mapping.dmp	servicehost
behavioral1/memory/1880-28-0x000000000043784E-mapping.dmp	servicehost
behavioral1/memory/1880-29-0x000000000043784E-mapping.dmp	servicehost
behavioral1/memory/1880-30-0x000000000043784E-mapping.dmp	servicehost

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1088 set thread context of 1880	1088	CNC 39200-pdf.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
844	1880	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1088	CNC 39200-pdf.exe
1088	CNC 39200-pdf.exe
1880	CNC 39200-pdf.exe
1880	CNC 39200-pdf.exe
844	WerFault.exe
844	WerFault.exe
844	WerFault.exe
844	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	CNC 39200-pdf.exe
Token: SeDebugPrivilege	1880	CNC 39200-pdf.exe
Token: SeDebugPrivilege	844	WerFault.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1880	1088	CNC 39200-pdf.exe	28
PID 1088 wrote to memory of 1880	1088	CNC 39200-pdf.exe	28
PID 1088 wrote to memory of 1880	1088	CNC 39200-pdf.exe	28
PID 1088 wrote to memory of 1880	1088	CNC 39200-pdf.exe	28
PID 1088 wrote to memory of 1880	1088	CNC 39200-pdf.exe	28
PID 1088 wrote to memory of 1880	1088	CNC 39200-pdf.exe	28
PID 1088 wrote to memory of 1880	1088	CNC 39200-pdf.exe	28
PID 1088 wrote to memory of 1880	1088	CNC 39200-pdf.exe	28
PID 1088 wrote to memory of 1880	1088	CNC 39200-pdf.exe	28
PID 1880 wrote to memory of 844	1880	CNC 39200-pdf.exe	30
PID 1880 wrote to memory of 844	1880	CNC 39200-pdf.exe	30
PID 1880 wrote to memory of 844	1880	CNC 39200-pdf.exe	30
PID 1880 wrote to memory of 844	1880	CNC 39200-pdf.exe	30

C:\Users\Admin\AppData\Local\Temp\CNC 39200-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\CNC 39200-pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\CNC 39200-pdf.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 1036
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-31-0x0000000002810000-0x0000000002821000-memory.dmp

Download

memory/844-14-0x0000000001DA0000-0x0000000001DB1000-memory.dmp

Download

memory/1088-1-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/1088-3-0x0000000000470000-0x0000000000474000-memory.dmp

Download

memory/1088-4-0x00000000059D0000-0x0000000005A46000-memory.dmp

Download

memory/1088-5-0x0000000005090000-0x0000000005100000-memory.dmp

Download

memory/1088-0-0x0000000073F10000-0x00000000745FE000-memory.dmp

Download

memory/1880-9-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1880-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1880-10-0x0000000073F10000-0x00000000745FE000-memory.dmp

Download

memory/1880-6-0x0000000000400000-0x000000000043C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads