995e93cb625f8495aaacca762984f75cd51d4b83dab87530ab52cd6feb71f18f

General

Target

IMG_4119.scr
Size

905KB
MD5

060cbc77c20d140b7ad9f90fd58d45c3
SHA1

f39d0f1ecb50884c69e81b2fd8f66c4b1d5c5cf4
SHA256

550615c0ae5984a323c65110142b7730c87cd0b4bdc6ff13052983ba8a6ec7ff
SHA512

525b3beb849c77b132eb77ea1424605b48d5406a5f93a7f10a13b7837e8c7f363ecca7a7b71169114386679a4dc98077a372461dbf43e062c56e116b4f350fe1

Score

10^/10

coreentity rezer0

Malware Config

Signatures

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral1/memory/2020-68-0x00000000008D0000-0x00000000008D8000-memory.dmp	coreentity

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/2020-69-0x0000000007A40000-0x0000000007AF0000-memory.dmp	rezer0

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

IMG_4119.scr

pid process

2020 IMG_4119.scr
2020 IMG_4119.scr
2020 IMG_4119.scr
2020 IMG_4119.scr
2020 IMG_4119.scr
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

IMG_4119.scr

description pid process

Token: SeDebugPrivilege 2020 IMG_4119.scr

pid	process
2020	IMG_4119.scr
2020	IMG_4119.scr
2020	IMG_4119.scr
2020	IMG_4119.scr
2020	IMG_4119.scr

description	pid	process
Token: SeDebugPrivilege	2020	IMG_4119.scr

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

IMG_4119.scr

description	pid	process	target process
PID 2020 wrote to memory of 1164	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 1164	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 1164	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 1164	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 804	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 804	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 804	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 804	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 1336	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 1336	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 1336	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 1336	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 828	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 828	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 828	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 828	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 976	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 976	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 976	2020	IMG_4119.scr	IMG_4119.scr
PID 2020 wrote to memory of 976	2020	IMG_4119.scr	IMG_4119.scr

C:\Users\Admin\AppData\Local\Temp\IMG_4119.scr
"C:\Users\Admin\AppData\Local\Temp\IMG_4119.scr" /S
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\IMG_4119.scr
"{path}"
2⤵
PID:1164

C:\Users\Admin\AppData\Local\Temp\IMG_4119.scr
"{path}"
2⤵
PID:804

C:\Users\Admin\AppData\Local\Temp\IMG_4119.scr
"{path}"
2⤵
PID:1336

C:\Users\Admin\AppData\Local\Temp\IMG_4119.scr
"{path}"
2⤵
PID:828

C:\Users\Admin\AppData\Local\Temp\IMG_4119.scr
"{path}"
2⤵
PID:976

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-54-0x00000000001D0000-0x00000000002B8000-memory.dmp

Filesize
928KB

Download
memory/2020-55-0x0000000072D20000-0x00000000740AF000-memory.dmp

Filesize
19.6MB

Download
memory/2020-56-0x0000000072310000-0x0000000072D20000-memory.dmp

Filesize
10.1MB

Download
memory/2020-57-0x00000000715F0000-0x000000007230D000-memory.dmp

Filesize
13.1MB

Download
memory/2020-58-0x0000000074940000-0x0000000074AD4000-memory.dmp

Filesize
1.6MB

Download
memory/2020-59-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/2020-60-0x0000000070E10000-0x00000000715F0000-memory.dmp

Filesize
7.9MB

Download
memory/2020-61-0x0000000074840000-0x000000007493C000-memory.dmp

Filesize
1008KB

Download
memory/2020-62-0x00000000706D0000-0x0000000070E0E000-memory.dmp

Filesize
7.2MB

Download
memory/2020-63-0x0000000072D20000-0x00000000740AF000-memory.dmp

Filesize
19.6MB

Download
memory/2020-64-0x0000000072310000-0x0000000072D20000-memory.dmp

Filesize
10.1MB

Download
memory/2020-65-0x00000000715F0000-0x000000007230D000-memory.dmp

Filesize
13.1MB

Download
memory/2020-66-0x0000000074940000-0x0000000074AD4000-memory.dmp

Filesize
1.6MB

Download
memory/2020-67-0x0000000074840000-0x000000007493C000-memory.dmp

Filesize
1008KB

Download
memory/2020-68-0x00000000008D0000-0x00000000008D8000-memory.dmp

Filesize
32KB

Download
memory/2020-69-0x0000000007A40000-0x0000000007AF0000-memory.dmp

Filesize
704KB

Download
memory/2020-70-0x00000000703C0000-0x0000000070591000-memory.dmp

Filesize
1.8MB

Download
memory/2020-71-0x0000000072D20000-0x00000000740AF000-memory.dmp

Filesize
19.6MB

Download
memory/2020-72-0x00000000715F0000-0x000000007230D000-memory.dmp

Filesize
13.1MB

Download
memory/2020-73-0x0000000072310000-0x0000000072D20000-memory.dmp

Filesize
10.1MB

Download
memory/2020-74-0x0000000074940000-0x0000000074AD4000-memory.dmp

Filesize
1.6MB

Download
memory/2020-75-0x00000000703C0000-0x0000000070591000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads