898fb94bb9fb9894ad31a2c4eec424aa0de35cfe8fb97f9da0914105d397ea3f

Analysis

Target
Purchase__quote.pdf.exe
Size 675KB
Sample201109-cxgbfppll6
SHA256 898fb94bb9fb9894ad31a2c4eec424aa0de35cfe8fb97f9da0914105d397ea3f
MD5 82c4743a0fdcf03a6542fcc1042cdff1
SHA1 84b8c6aba5df844cd70f757594766187c911db39
SHA512 b3a88d0f57c89197006b4acf3cb98fe2480ed51da28f20e42a13450b48099d86a86248ecb55d5062a411f6f5ccd1b2b42758252dd2b32d984193183b7d20bba6
MD5 SHA1 SHA512

Score

9^/10

rezer0

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

resource	yara_rule
behavioral1/memory/1732-4-0x0000000001EC0000-0x0000000001F13000-memory.dmp	rezer0

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	Purchase__quote.pdf.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 272	1732	Purchase__quote.pdf.exe	29
PID 1732 wrote to memory of 272	1732	Purchase__quote.pdf.exe	29
PID 1732 wrote to memory of 272	1732	Purchase__quote.pdf.exe	29
PID 1732 wrote to memory of 272	1732	Purchase__quote.pdf.exe	29
PID 1732 wrote to memory of 396	1732	Purchase__quote.pdf.exe	30
PID 1732 wrote to memory of 396	1732	Purchase__quote.pdf.exe	30
PID 1732 wrote to memory of 396	1732	Purchase__quote.pdf.exe	30
PID 1732 wrote to memory of 396	1732	Purchase__quote.pdf.exe	30
PID 1732 wrote to memory of 980	1732	Purchase__quote.pdf.exe	31
PID 1732 wrote to memory of 980	1732	Purchase__quote.pdf.exe	31
PID 1732 wrote to memory of 980	1732	Purchase__quote.pdf.exe	31
PID 1732 wrote to memory of 980	1732	Purchase__quote.pdf.exe	31
PID 1732 wrote to memory of 572	1732	Purchase__quote.pdf.exe	32
PID 1732 wrote to memory of 572	1732	Purchase__quote.pdf.exe	32
PID 1732 wrote to memory of 572	1732	Purchase__quote.pdf.exe	32
PID 1732 wrote to memory of 572	1732	Purchase__quote.pdf.exe	32
PID 1732 wrote to memory of 304	1732	Purchase__quote.pdf.exe	33
PID 1732 wrote to memory of 304	1732	Purchase__quote.pdf.exe	33
PID 1732 wrote to memory of 304	1732	Purchase__quote.pdf.exe	33
PID 1732 wrote to memory of 304	1732	Purchase__quote.pdf.exe	33

C:\Users\Admin\AppData\Local\Temp\Purchase__quote.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase__quote.pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\Purchase__quote.pdf.exe
  "{path}"
  2⤵
  PID:272
- C:\Users\Admin\AppData\Local\Temp\Purchase__quote.pdf.exe
  "{path}"
  2⤵
  PID:396
- C:\Users\Admin\AppData\Local\Temp\Purchase__quote.pdf.exe
  "{path}"
  2⤵
  PID:980
- C:\Users\Admin\AppData\Local\Temp\Purchase__quote.pdf.exe
  "{path}"
  2⤵
  PID:572
- C:\Users\Admin\AppData\Local\Temp\Purchase__quote.pdf.exe
  "{path}"
  2⤵
  PID:304

memory/1732-0-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Download

memory/1732-1-0x0000000000390000-0x0000000000391000-memory.dmp

Download

memory/1732-3-0x0000000000250000-0x0000000000252000-memory.dmp

Download

memory/1732-4-0x0000000001EC0000-0x0000000001F13000-memory.dmp

Download