Overview

overview

10

Static

static

PI 2000006...df.exe

windows7_x64

9

PI 2000006...df.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    41s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 01:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PI 200000679 Rev 3_pdf.exe

  • Size

    1.1MB

  • MD5

    87084086939792c1a2ccbb561c4fd598

  • SHA1

    3f52ccd6b2ab2618ce47e83bdc858cebea390544

  • SHA256

    a2a4fc12990dcf4a9778f96840b49be84f9563edd2b5209b6dac1ffb2ed8e38d

  • SHA512

    1a8b214bdfa2d9ef2243b3ab874947625b7074f09a3a2c0d8e6ba33697f8723c9ce145756600b1fd2c3119b0deda311f42ab7de64034f8d445a6ac44a472048d

Score
9/10
rezer0

Malware Config

Signatures

  • ReZer0 packer 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PI 200000679 Rev 3_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\PI 200000679 Rev 3_pdf.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1012
    • C:\Users\Admin\AppData\Local\Temp\PI 200000679 Rev 3_pdf.exe
      "{path}"
      2⤵
        PID:1984
      • C:\Users\Admin\AppData\Local\Temp\PI 200000679 Rev 3_pdf.exe
        "{path}"
        2⤵
          PID:2028
        • C:\Users\Admin\AppData\Local\Temp\PI 200000679 Rev 3_pdf.exe
          "{path}"
          2⤵
            PID:2044
          • C:\Users\Admin\AppData\Local\Temp\PI 200000679 Rev 3_pdf.exe
            "{path}"
            2⤵
              PID:1100
            • C:\Users\Admin\AppData\Local\Temp\PI 200000679 Rev 3_pdf.exe
              "{path}"
              2⤵
                PID:1712

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1012-54-0x00000000002F0000-0x0000000000408000-memory.dmp

              Filesize

              1.1MB

              Download

            • memory/1012-55-0x0000000000440000-0x0000000000448000-memory.dmp

              Filesize

              32KB

              Download

            • memory/1012-56-0x0000000007E20000-0x0000000007ECE000-memory.dmp

              Filesize

              696KB

              Download