06b09dbc5f29a7e703a6ef58aa476840cf8dfd0464d6bcf8882a4aab6a791303

General

Target

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Size

188KB
MD5

e3ace455382fa7708264257983339263
SHA1

ab979cc544c46903d41fe773c568e2fa54a9bc44
SHA256

f2d682b9bd2857603944471a9baf4a8d83a897d7be57dbf473c8f07fd8f5ed1a
SHA512

be4a8e0770d30eb888a27490954b6109353673234f3b30b3c384d624ff79f3171a3ffff310883cb2f0930f0c64edb716171a78b3a166b44d855c08a0742c46ff
SSDEEP

3072:gudusODvGZVHhS1drkr3k1hsz3F8ol/Lg7Qir8B/xjcbfMrRPyczWIqT9tYhOddx:k9+phSzOFUs/F08PLWIqT2M

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

564 cmd.exe

pid	process
564	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

description	pid	process	target process
PID 1348 set thread context of 1204	1348	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exerechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exeExplorer.EXE

pid	process
1348	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1204	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1204	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE

pid	process
1208	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1204	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Token: SeDebugPrivilege	1208	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE
1208 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE
1208 Explorer.EXE

pid	process
1208	Explorer.EXE
1208	Explorer.EXE

pid	process
1208	Explorer.EXE
1208	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

pid	process
1348	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1348	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE

pid	process
1208	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exerechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exeExplorer.EXE

description	pid	process	target process
PID 1348 wrote to memory of 1204	1348	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1348 wrote to memory of 1204	1348	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1348 wrote to memory of 1204	1348	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1348 wrote to memory of 1204	1348	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1348 wrote to memory of 1204	1348	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1348 wrote to memory of 1204	1348	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1348 wrote to memory of 1204	1348	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1348 wrote to memory of 1204	1348	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1348 wrote to memory of 1204	1348	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1348 wrote to memory of 1204	1348	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1204 wrote to memory of 564	1204	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 1204 wrote to memory of 564	1204	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 1204 wrote to memory of 564	1204	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 1204 wrote to memory of 564	1204	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 1204 wrote to memory of 1208	1204	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	Explorer.EXE
PID 1208 wrote to memory of 1068	1208	Explorer.EXE	taskhost.exe
PID 1208 wrote to memory of 1164	1208	Explorer.EXE	Dwm.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1068

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1208

C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
"C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348

C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ms284298.bat"
4⤵
- Deletes itself
PID:564

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms284298.bat

Filesize
201B

MD5
ad86d80cac143da63b3a4f847db36716

SHA1
67ba9464badbffab6dddcd610d5b5100036b2693

SHA256
12cacb7cb1a8e8c2f221f4efd806018a875c006164db8c5874e4dd8465fba94a

SHA512
5a93f693311885d7327c3c5836dd2cb2f60a8c604614afb3b296849468996f2a52777a1014b27adf19f3467891d4b789f6ace143cc9b291dc731ec2fd9499b8d

Download Submit
memory/564-71-0x0000000000000000-mapping.dmp

Download
memory/1068-83-0x0000000000230000-0x0000000000247000-memory.dmp

Filesize
92KB

Download
memory/1068-81-0x00000000371A0000-0x00000000371B0000-memory.dmp

Filesize
64KB

Download
memory/1164-85-0x00000000001A0000-0x00000000001B7000-memory.dmp

Filesize
92KB

Download
memory/1164-82-0x00000000371A0000-0x00000000371B0000-memory.dmp

Filesize
64KB

Download
memory/1204-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1204-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1204-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1204-64-0x00000000004010C0-mapping.dmp

Download
memory/1204-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1204-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1204-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1204-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1204-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1208-72-0x0000000001C50000-0x0000000001C67000-memory.dmp

Filesize
92KB

Download
memory/1208-84-0x0000000001C50000-0x0000000001C67000-memory.dmp

Filesize
92KB

Download
memory/1208-75-0x00000000371A0000-0x00000000371B0000-memory.dmp

Filesize
64KB

Download
memory/1348-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1348-65-0x0000000000270000-0x0000000000274000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads