1fe1a4df80a217b3345109b0ed5d031042cf0db92c30ecbfc5c98ee3138747ea

General

Target

INVOICE-#0000898876-PDF.exe
Size

725KB
MD5

59e9a62140afacf335fd293eb2d868e4
SHA1

c04a8bd8a4667b5c213e59dbd838a34cc363fdcd
SHA256

1fe1a4df80a217b3345109b0ed5d031042cf0db92c30ecbfc5c98ee3138747ea
SHA512

7466cb34f14540ea602af91a91d71e981109695d611d71d49623e8232cd35dc803089c7030ae45c369eaf790c773051bc55d2324ce059b54c63340d55a472cb7
SSDEEP

12288:s8tYMjhvPie/rByY7777777777777y1dKEdOPbAvNap7wIfc+hLbi8p0F2JTF/IQ:fYMFniyy1d7d8b/7woda8p0FA5A+igTH

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2268 set thread context of 2348	2268	INVOICE-#0000898876-PDF.exe	28
PID 2348 set thread context of 1304	2348	INVOICE-#0000898876-PDF.exe	21
PID 2348 set thread context of 2560	2348	INVOICE-#0000898876-PDF.exe	31
PID 2560 set thread context of 1304	2560	raserver.exe	21

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2348	INVOICE-#0000898876-PDF.exe
2348	INVOICE-#0000898876-PDF.exe
2348	INVOICE-#0000898876-PDF.exe
2348	INVOICE-#0000898876-PDF.exe
2348	INVOICE-#0000898876-PDF.exe
2348	INVOICE-#0000898876-PDF.exe
2348	INVOICE-#0000898876-PDF.exe
2348	INVOICE-#0000898876-PDF.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe
2560	raserver.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2348	INVOICE-#0000898876-PDF.exe
1304	Explorer.EXE
1304	Explorer.EXE
2560	raserver.exe
2560	raserver.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2348	2268	INVOICE-#0000898876-PDF.exe	28
PID 2268 wrote to memory of 2348	2268	INVOICE-#0000898876-PDF.exe	28
PID 2268 wrote to memory of 2348	2268	INVOICE-#0000898876-PDF.exe	28
PID 2268 wrote to memory of 2348	2268	INVOICE-#0000898876-PDF.exe	28
PID 2268 wrote to memory of 2348	2268	INVOICE-#0000898876-PDF.exe	28
PID 2268 wrote to memory of 2348	2268	INVOICE-#0000898876-PDF.exe	28
PID 2268 wrote to memory of 2348	2268	INVOICE-#0000898876-PDF.exe	28
PID 1304 wrote to memory of 2560	1304	Explorer.EXE	31
PID 1304 wrote to memory of 2560	1304	Explorer.EXE	31
PID 1304 wrote to memory of 2560	1304	Explorer.EXE	31
PID 1304 wrote to memory of 2560	1304	Explorer.EXE	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Local\Temp\INVOICE-#0000898876-PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\INVOICE-#0000898876-PDF.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Users\Admin\AppData\Local\Temp\INVOICE-#0000898876-PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\INVOICE-#0000898876-PDF.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2348
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\SysWOW64\raserver.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-30-0x0000000009520000-0x000000000AF3E000-memory.dmp

Filesize
26.1MB

Download
memory/1304-22-0x0000000009520000-0x000000000AF3E000-memory.dmp

Filesize
26.1MB

Download
memory/1304-20-0x0000000003080000-0x0000000003180000-memory.dmp

Filesize
1024KB

Download
memory/2268-0-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/2268-1-0x00000000013E0000-0x000000000149C000-memory.dmp

Filesize
752KB

Download
memory/2268-2-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2268-3-0x0000000000570000-0x0000000000590000-memory.dmp

Filesize
128KB

Download
memory/2268-4-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/2268-5-0x0000000000770000-0x0000000000786000-memory.dmp

Filesize
88KB

Download
memory/2268-6-0x00000000051F0000-0x000000000527A000-memory.dmp

Filesize
552KB

Download
memory/2268-15-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2348-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-16-0x0000000000920000-0x0000000000C23000-memory.dmp

Filesize
3.0MB

Download
memory/2348-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2348-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-21-0x00000000002A0000-0x00000000002BD000-memory.dmp

Filesize
116KB

Download
memory/2348-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-26-0x00000000002A0000-0x00000000002BD000-memory.dmp

Filesize
116KB

Download
memory/2560-23-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/2560-27-0x0000000001F10000-0x0000000002213000-memory.dmp

Filesize
3.0MB

Download
memory/2560-28-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/2560-29-0x0000000001D80000-0x0000000001E1C000-memory.dmp

Filesize
624KB

Download
memory/2560-24-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/2560-31-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing