bdefd80ebc99c33bb0bfa9db249680c258ba3e55fd704c22fda1f015ca7aed32

Analysis

max time kernel
117s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2023, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RQ038023.PDF.exe
Size 588KB
Sample230815-phra4aaf64
SHA256 bdefd80ebc99c33bb0bfa9db249680c258ba3e55fd704c22fda1f015ca7aed32
MD5 2dbdc96135002d650ff6ec39bce979d7
SHA1 d8d6352a8d9362600db113467a5abeb654ddc0cf
SHA512 90eca5aec23ee9f2e99932ae531c45bb1fe80fe635e0d1becc255c0090f34c358115034ee68bd4ca3bef3af985873bf73ead2cf10c694076bc6fbd7af51614fd
SSDEEP 12288:GPV/OvRm6fQv9/DkdVl4cq8UTxW1U/4uUPE2lETspFhdmQZD:LvRAFbO4cq8UTxWntqWr
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1968 set thread context of 4528	1968	RQ038023.PDF.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4528	RegSvcs.exe
4528	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4528	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 4528	1968	RQ038023.PDF.exe	90
PID 1968 wrote to memory of 4528	1968	RQ038023.PDF.exe	90
PID 1968 wrote to memory of 4528	1968	RQ038023.PDF.exe	90
PID 1968 wrote to memory of 4528	1968	RQ038023.PDF.exe	90
PID 1968 wrote to memory of 4528	1968	RQ038023.PDF.exe	90
PID 1968 wrote to memory of 4528	1968	RQ038023.PDF.exe	90
PID 1968 wrote to memory of 4528	1968	RQ038023.PDF.exe	90
PID 1968 wrote to memory of 4528	1968	RQ038023.PDF.exe	90

C:\Users\Admin\AppData\Local\Temp\RQ038023.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\RQ038023.PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-139-0x0000000005AF0000-0x0000000005B8C000-memory.dmp

Download

memory/1968-140-0x0000000074510000-0x0000000074CC0000-memory.dmp

Download

memory/1968-135-0x0000000005FE0000-0x0000000006584000-memory.dmp

Download

memory/1968-136-0x00000000058E0000-0x0000000005972000-memory.dmp

Download

memory/1968-137-0x0000000005BB0000-0x0000000005BC0000-memory.dmp

Download

memory/1968-138-0x00000000059A0000-0x00000000059AA000-memory.dmp

Download

memory/1968-134-0x0000000074510000-0x0000000074CC0000-memory.dmp

Download

memory/1968-145-0x0000000074510000-0x0000000074CC0000-memory.dmp

Download

memory/1968-133-0x0000000000EC0000-0x0000000000F58000-memory.dmp

Download

memory/1968-141-0x0000000005BB0000-0x0000000005BC0000-memory.dmp

Download

memory/4528-142-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4528-144-0x0000000074510000-0x0000000074CC0000-memory.dmp

Download

memory/4528-146-0x0000000006690000-0x00000000066E0000-memory.dmp

Download

memory/4528-147-0x00000000068B0000-0x0000000006A72000-memory.dmp

Download

memory/4528-148-0x0000000074510000-0x0000000074CC0000-memory.dmp

Download