Analysis
- max time kernel
134s - max time network
121s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/02/2021, 13:55
General
- Target Rechnung.exe
- Size 570KB
- Sample210217-7fmax68x7j
- SHA256 a86039e7c66e0d06ca519938dc7f2158288f4a4f5154a80ae7f9b24b35ba7253
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rechnung.exe"C:\Users\Admin\AppData\Local\Temp\Rechnung.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/504-2-0x0000000073920000-0x000000007400E000-memory.dmp
memory/504-3-0x0000000000CA0000-0x0000000000CA1000-memory.dmp
memory/504-5-0x00000000055C0000-0x00000000055C1000-memory.dmp
memory/504-6-0x0000000005B60000-0x0000000005B61000-memory.dmp
memory/504-7-0x0000000005660000-0x0000000005661000-memory.dmp
memory/504-8-0x0000000005560000-0x0000000005561000-memory.dmp
memory/504-9-0x0000000005820000-0x0000000005821000-memory.dmp
memory/504-10-0x0000000006060000-0x0000000006061000-memory.dmp
memory/504-11-0x0000000005550000-0x0000000005551000-memory.dmp
memory/504-12-0x0000000005B20000-0x0000000005B24000-memory.dmp
memory/504-13-0x00000000015A0000-0x000000000160E000-memory.dmp
memory/752-14-0x0000000000400000-0x000000000043C000-memory.dmp
memory/752-16-0x0000000073920000-0x000000007400E000-memory.dmp
memory/752-21-0x0000000005300000-0x0000000005301000-memory.dmp
memory/752-22-0x0000000005450000-0x0000000005451000-memory.dmp
memory/752-23-0x0000000006120000-0x0000000006121000-memory.dmp