Analysis
- max time kernel
149s - max time network
142s - platform
windows10_x64 - resource
win10v200722 - submitted
14/10/2020, 16:36
General
- Target CNC 39200-pdf.exe
- Size 676KB
- Sample201014-dhfw6wsaqe
- SHA256 d9ef6dd0ddbe95b3f858ec1e3cb40d5493c89f8844227f2c31739a9e7cef7ab9
Malware Config
Signatures
- ServiceHost packer 11 IoCs
Detects ServiceHost packer used for .NET malware
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CNC 39200-pdf.exe"C:\Users\Admin\AppData\Local\Temp\CNC 39200-pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CNC 39200-pdf.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 14163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/192-34-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/192-20-0x00000000045C0000-0x00000000045C1000-memory.dmp
memory/532-0-0x0000000073C70000-0x000000007435E000-memory.dmp
memory/532-1-0x00000000009C0000-0x00000000009C1000-memory.dmp
memory/532-3-0x0000000005870000-0x0000000005871000-memory.dmp
memory/532-4-0x0000000005410000-0x0000000005411000-memory.dmp
memory/532-5-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/532-6-0x0000000005640000-0x0000000005644000-memory.dmp
memory/532-7-0x0000000007990000-0x0000000007991000-memory.dmp
memory/532-8-0x0000000007B30000-0x0000000007BA6000-memory.dmp
memory/532-9-0x000000000A3C0000-0x000000000A430000-memory.dmp
memory/3052-19-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/3052-13-0x0000000073C70000-0x000000007435E000-memory.dmp
memory/3052-18-0x0000000005360000-0x0000000005361000-memory.dmp
memory/3052-10-0x0000000000400000-0x000000000043C000-memory.dmp