Analysis
- max time kernel
102s - max time network
115s - platform
windows10_x64 - resource
win10v20201028 - submitted
04/11/2020, 01:30
General
- Target RFQ-PO_9475909HG7_Sample&Specifications,pdf.exe
- Size 758KB
- Sample201104-d57sqyl8hs
- SHA256 80c4f287136c2fef0b36fdc744f31bc4e6e1b2ad7185e5074ea655f00e1e170d
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ-PO_9475909HG7_Sample&Specifications,pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-PO_9475909HG7_Sample&Specifications,pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PhiBZrGaz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2646.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ-PO_9475909HG7_Sample&Specifications,pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-PO_9475909HG7_Sample&Specifications,pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3276-22-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/3276-21-0x0000000005160000-0x0000000005161000-memory.dmp
memory/3276-16-0x0000000073E30000-0x000000007451E000-memory.dmp
memory/3276-13-0x0000000000400000-0x000000000043C000-memory.dmp
memory/4640-5-0x0000000005190000-0x0000000005191000-memory.dmp
memory/4640-10-0x0000000005F70000-0x0000000005FA9000-memory.dmp
memory/4640-9-0x0000000005F00000-0x0000000005F6E000-memory.dmp
memory/4640-8-0x00000000050D0000-0x00000000050DB000-memory.dmp
memory/4640-7-0x00000000053A0000-0x00000000053A1000-memory.dmp
memory/4640-6-0x0000000005090000-0x0000000005091000-memory.dmp
memory/4640-0-0x0000000073E30000-0x000000007451E000-memory.dmp
memory/4640-4-0x0000000005690000-0x0000000005691000-memory.dmp
memory/4640-3-0x00000000050F0000-0x00000000050F1000-memory.dmp
memory/4640-1-0x00000000007C0000-0x00000000007C1000-memory.dmp