539900a999853a6783c7e700987248efd3307604d5ca3cc4bdc3e69cf3489e06

Analysis

max time kernel
20s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1Q7PqKI00aILjFM.exe
Size 773KB
Sample201109-t1e8jdhm66
SHA256 539900a999853a6783c7e700987248efd3307604d5ca3cc4bdc3e69cf3489e06
MD5 bbc109b66d0e3ac4a6e6b3902c925f1d
SHA1 aac80004e905515aa4742688b137b5fe501cc1d9
SHA512 d0834d6a620cae190ed77d43c341f549a026d29ebeef2391958ce2c032b2e7a886fd401653fa2f030e506b3fa3627cfacbfcf1a86d5b243a1508dfa5fdab6092
MD5 SHA1 SHA512

Score

9^/10

rezer0

Malware Config

Signatures

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral2/memory/656-14-0x0000000007A40000-0x0000000007AA2000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 656 set thread context of 3164	656	1Q7PqKI00aILjFM.exe	75

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
656	1Q7PqKI00aILjFM.exe
656	1Q7PqKI00aILjFM.exe
656	1Q7PqKI00aILjFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3164	1Q7PqKI00aILjFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	656	1Q7PqKI00aILjFM.exe
Token: SeDebugPrivilege	3164	1Q7PqKI00aILjFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3164	1Q7PqKI00aILjFM.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 3164	656	1Q7PqKI00aILjFM.exe	75
PID 656 wrote to memory of 3164	656	1Q7PqKI00aILjFM.exe	75
PID 656 wrote to memory of 3164	656	1Q7PqKI00aILjFM.exe	75
PID 656 wrote to memory of 3164	656	1Q7PqKI00aILjFM.exe	75
PID 656 wrote to memory of 3164	656	1Q7PqKI00aILjFM.exe	75
PID 656 wrote to memory of 3164	656	1Q7PqKI00aILjFM.exe	75
PID 656 wrote to memory of 3164	656	1Q7PqKI00aILjFM.exe	75
PID 656 wrote to memory of 3164	656	1Q7PqKI00aILjFM.exe	75

C:\Users\Admin\AppData\Local\Temp\1Q7PqKI00aILjFM.exe
"C:\Users\Admin\AppData\Local\Temp\1Q7PqKI00aILjFM.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:656
- C:\Users\Admin\AppData\Local\Temp\1Q7PqKI00aILjFM.exe
  "{path}"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-0-0x0000000074070000-0x000000007475E000-memory.dmp

Download

memory/656-1-0x0000000000380000-0x0000000000381000-memory.dmp

Download

memory/656-3-0x0000000004C60000-0x0000000004CCA000-memory.dmp

Download

memory/656-4-0x00000000055E0000-0x00000000055E1000-memory.dmp

Download

memory/656-7-0x0000000005180000-0x0000000005181000-memory.dmp

Download

memory/656-11-0x0000000005140000-0x0000000005141000-memory.dmp

Download

memory/656-12-0x00000000053A0000-0x00000000053A3000-memory.dmp

Download

memory/656-13-0x00000000078D0000-0x00000000078D1000-memory.dmp

Download

memory/656-14-0x0000000007A40000-0x0000000007AA2000-memory.dmp

Download

memory/3164-15-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3164-17-0x0000000074070000-0x000000007475E000-memory.dmp

Download