1c22bad3a6eb408ec1f4d6ef50b04e2294a77979abc411f9dbb752e2b495345b

Analysis

max time kernel
35s
max time network
11s
platform
windows7_x64
resource
win7v20201028
submitted
11-12-2020 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SMT20200616.exe
Size

311KB
MD5

9eda8430e6bf0bab3f1e7134b584cd1b
SHA1

03b3d3d673686f0bd4316bd99c0a135e6e3250ba
SHA256

1c22bad3a6eb408ec1f4d6ef50b04e2294a77979abc411f9dbb752e2b495345b
SHA512

6ad03fb677542c246814976b473d033c743d0cee598139f96cd91e1c0fb958bc0dba5ad712b9fc61c72df09fcdf1b762ef0ae77f5692d6b7f1252935eb40cf78

Score

9^/10

rezer0

Malware Config

Signatures

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/776-6-0x0000000002180000-0x00000000021B4000-memory.dmp	rezer0

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

SMT20200616.exe

pid	process
776	SMT20200616.exe
776	SMT20200616.exe
776	SMT20200616.exe
776	SMT20200616.exe
776	SMT20200616.exe
776	SMT20200616.exe
776	SMT20200616.exe
776	SMT20200616.exe
776	SMT20200616.exe
776	SMT20200616.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SMT20200616.exe

description pid process

Token: SeDebugPrivilege 776 SMT20200616.exe

description	pid	process
Token: SeDebugPrivilege	776	SMT20200616.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

SMT20200616.exe

description	pid	process	target process
PID 776 wrote to memory of 1532	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 1532	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 1532	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 1532	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 1628	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 1628	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 1628	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 1628	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 840	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 840	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 840	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 840	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 1204	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 1204	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 1204	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 1204	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 1712	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 1712	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 1712	776	SMT20200616.exe	SMT20200616.exe
PID 776 wrote to memory of 1712	776	SMT20200616.exe	SMT20200616.exe

C:\Users\Admin\AppData\Local\Temp\SMT20200616.exe
"C:\Users\Admin\AppData\Local\Temp\SMT20200616.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:776

C:\Users\Admin\AppData\Local\Temp\SMT20200616.exe
"{path}"
2⤵
PID:1532

C:\Users\Admin\AppData\Local\Temp\SMT20200616.exe
"{path}"
2⤵
PID:1628

C:\Users\Admin\AppData\Local\Temp\SMT20200616.exe
"{path}"
2⤵
PID:840

C:\Users\Admin\AppData\Local\Temp\SMT20200616.exe
"{path}"
2⤵
PID:1204

C:\Users\Admin\AppData\Local\Temp\SMT20200616.exe
"{path}"
2⤵
PID:1712

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-2-0x0000000073D40000-0x000000007442E000-memory.dmp

Filesize
6.9MB

Download
memory/776-3-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/776-5-0x0000000000350000-0x000000000035B000-memory.dmp

Filesize
44KB

Download
memory/776-6-0x0000000002180000-0x00000000021B4000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads