Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:25
Static task
static1
Behavioral task
behavioral1
Sample
1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
Resource
win10v2004-20221111-en
General
-
Target
1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
-
Size
176KB
-
MD5
13997ebf7af8d37dda6697ac03f76cc3
-
SHA1
9be2bcd498406bdfb05f860ad726273c4a7b4f3a
-
SHA256
11ecf58db103eb2ded5b942f303d48b5d77e336b8edfe335fa7b81264d1f50ef
-
SHA512
2894ef41ec784fb39ec663ff8ca5fa8c0ebbd875f95f6e2b843c8bca59d63cc7c43f64df43898290cef31c4b32478819f437fcc4656606d0f7cd4721c735ffee
-
SSDEEP
3072:rGwR1qmB1TQgHtMF5a6I4Ya5Tlrjmvl3XymSPTyAAwoc9+IkMd+zr3/1C:7KLa6I4x3mdnCNAwo42M
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 628 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ypbkryye.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ypbkryye.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exedescription pid process target process PID 1108 set thread context of 1492 1108 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exeExplorer.EXEpid process 1108 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe 1492 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe 1492 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1492 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe Token: SeDebugPrivilege 1360 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exepid process 1108 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe 1108 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exeExplorer.EXEdescription pid process target process PID 1108 wrote to memory of 1492 1108 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe PID 1108 wrote to memory of 1492 1108 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe PID 1108 wrote to memory of 1492 1108 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe PID 1108 wrote to memory of 1492 1108 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe PID 1108 wrote to memory of 1492 1108 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe PID 1108 wrote to memory of 1492 1108 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe PID 1108 wrote to memory of 1492 1108 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe PID 1108 wrote to memory of 1492 1108 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe PID 1108 wrote to memory of 1492 1108 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe PID 1108 wrote to memory of 1492 1108 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe PID 1492 wrote to memory of 628 1492 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe cmd.exe PID 1492 wrote to memory of 628 1492 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe cmd.exe PID 1492 wrote to memory of 628 1492 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe cmd.exe PID 1492 wrote to memory of 628 1492 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe cmd.exe PID 1492 wrote to memory of 1360 1492 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe Explorer.EXE PID 1360 wrote to memory of 1228 1360 Explorer.EXE taskhost.exe PID 1360 wrote to memory of 1316 1360 Explorer.EXE Dwm.exe PID 1360 wrote to memory of 628 1360 Explorer.EXE cmd.exe PID 1360 wrote to memory of 628 1360 Explorer.EXE cmd.exe PID 1360 wrote to memory of 1724 1360 Explorer.EXE conhost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe"C:\Users\Admin\AppData\Local\Temp\1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exeC:\Users\Admin\AppData\Local\Temp\1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS9336~1.BAT"4⤵
- Deletes itself
PID:628
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1316
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1228
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1102069756775588698-1776972618-2110051450-1010069717-1237682089-21162318701886972310"1⤵PID:1724
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms9336058.batFilesize
201B
MD5d6a95645c03db0adc7b03e1ca1d19ee4
SHA1d25998056ec179a69ec8c8ee58fd8a395f866868
SHA256291311364668c1da13a1e0ac48e1e8db2f758088aea18e4e71014cfc14c174a5
SHA512643065c181f579570a69332e49749193c4ab09ca9e3058a0be9ee605e3be2cc9bda294ad0033c760adb91357707a7d43a3524a1633cb63446514c1b96fc6d59e
-
memory/628-73-0x0000000000000000-mapping.dmp
-
memory/628-93-0x00000000001A0000-0x00000000001B4000-memory.dmpFilesize
80KB
-
memory/628-82-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/628-90-0x00000000378E0000-0x00000000378F0000-memory.dmpFilesize
64KB
-
memory/1108-67-0x0000000000400000-0x0000000000520000-memory.dmpFilesize
1.1MB
-
memory/1108-69-0x0000000000250000-0x0000000000254000-memory.dmpFilesize
16KB
-
memory/1108-54-0x0000000000400000-0x0000000000520000-memory.dmpFilesize
1.1MB
-
memory/1108-55-0x0000000075B41000-0x0000000075B43000-memory.dmpFilesize
8KB
-
memory/1228-96-0x0000000001CA0000-0x0000000001CB7000-memory.dmpFilesize
92KB
-
memory/1228-83-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/1316-92-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/1316-97-0x0000000000120000-0x0000000000137000-memory.dmpFilesize
92KB
-
memory/1360-95-0x0000000002160000-0x0000000002177000-memory.dmpFilesize
92KB
-
memory/1360-77-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/1360-74-0x0000000002160000-0x0000000002177000-memory.dmpFilesize
92KB
-
memory/1492-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1492-59-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1492-57-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1492-68-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1492-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1492-65-0x00000000004010C0-mapping.dmp
-
memory/1492-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1492-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1492-76-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1724-91-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/1724-94-0x0000000000230000-0x0000000000247000-memory.dmpFilesize
92KB