Analysis
-
max time kernel
144s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 04:25
Static task
static1
Behavioral task
behavioral1
Sample
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
Resource
win10v2004-20221111-en
General
-
Target
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
-
Size
176KB
-
MD5
13997ebf7af8d37dda6697ac03f76cc3
-
SHA1
9be2bcd498406bdfb05f860ad726273c4a7b4f3a
-
SHA256
11ecf58db103eb2ded5b942f303d48b5d77e336b8edfe335fa7b81264d1f50ef
-
SHA512
2894ef41ec784fb39ec663ff8ca5fa8c0ebbd875f95f6e2b843c8bca59d63cc7c43f64df43898290cef31c4b32478819f437fcc4656606d0f7cd4721c735ffee
-
SSDEEP
3072:rGwR1qmB1TQgHtMF5a6I4Ya5Tlrjmvl3XymSPTyAAwoc9+IkMd+zr3/1C:7KLa6I4x3mdnCNAwo42M
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tyevtgrk.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\tyevtgrk.exe\"" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exedescription pid process target process PID 3512 set thread context of 4544 3512 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exerechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exeExplorer.EXEpid process 3512 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 3512 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 4544 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 4544 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 676 Explorer.EXE 676 Explorer.EXE 676 Explorer.EXE 676 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4544 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Token: SeDebugPrivilege 676 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exepid process 3512 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe 3512 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exerechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exeExplorer.EXEdescription pid process target process PID 3512 wrote to memory of 4544 3512 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 3512 wrote to memory of 4544 3512 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 3512 wrote to memory of 4544 3512 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 3512 wrote to memory of 4544 3512 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 3512 wrote to memory of 4544 3512 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 3512 wrote to memory of 4544 3512 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 3512 wrote to memory of 4544 3512 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 3512 wrote to memory of 4544 3512 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 3512 wrote to memory of 4544 3512 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe PID 4544 wrote to memory of 336 4544 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe cmd.exe PID 4544 wrote to memory of 336 4544 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe cmd.exe PID 4544 wrote to memory of 336 4544 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe cmd.exe PID 4544 wrote to memory of 676 4544 rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe Explorer.EXE PID 676 wrote to memory of 2680 676 Explorer.EXE sihost.exe PID 676 wrote to memory of 2776 676 Explorer.EXE svchost.exe PID 676 wrote to memory of 2844 676 Explorer.EXE taskhostw.exe PID 676 wrote to memory of 3096 676 Explorer.EXE svchost.exe PID 676 wrote to memory of 3292 676 Explorer.EXE DllHost.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe"C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exeC:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6116~1.BAT"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/336-139-0x0000000000000000-mapping.dmp
-
memory/676-141-0x00007FF7E9530000-0x00007FF7E9540000-memory.dmpFilesize
64KB
-
memory/3512-132-0x0000000000400000-0x0000000000520000-memory.dmpFilesize
1.1MB
-
memory/3512-136-0x0000000000400000-0x0000000000520000-memory.dmpFilesize
1.1MB
-
memory/3512-138-0x0000000000BB0000-0x0000000000BB4000-memory.dmpFilesize
16KB
-
memory/4544-133-0x0000000000000000-mapping.dmp
-
memory/4544-134-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4544-137-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4544-140-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB