7970571d2325a8e59e85c615aecf2749e3c6b290010bc82fbfe387ae4db5fa83

General

Target

rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
Size

196KB
MD5

03c97952e19ce93941404ef9a3a935f5
SHA1

ec7edb6a0b5f14c7017ba645e269c8598633e384
SHA256

e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0
SHA512

713b638f2f4f0870798ae66e14a81de302612b8aec3dc4cb1ce169b6df9be3aa89746dae4b31b0cd98ada46bd0fda3e42c8b4992c04ef6635bd112a137339f7f
SSDEEP

3072:9udusODvGZVHhX1drkr3k1qusMrf/Kf2DWJEi/i0D2D7oyCT8nVn1QJsYvVnGd+z:59+phXzpsML/E2DH0yDTV13Y5z

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1564	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\engtvbbi.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\engtvbbi.exe\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 568 set thread context of 868	568	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
568	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
868	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
868	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1260	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	868	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
Token: SeDebugPrivilege	1260	Explorer.EXE
Token: SeShutdownPrivilege	1260	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1260	Explorer.EXE
1260	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1260	Explorer.EXE
1260	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
568	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
568	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1260	Explorer.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 868	568	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 568 wrote to memory of 868	568	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 568 wrote to memory of 868	568	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 568 wrote to memory of 868	568	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 568 wrote to memory of 868	568	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 568 wrote to memory of 868	568	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 568 wrote to memory of 868	568	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 568 wrote to memory of 868	568	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 568 wrote to memory of 868	568	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 568 wrote to memory of 868	568	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 868 wrote to memory of 1564	868	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	29
PID 868 wrote to memory of 1564	868	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	29
PID 868 wrote to memory of 1564	868	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	29
PID 868 wrote to memory of 1564	868	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	29
PID 868 wrote to memory of 1260	868	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	20
PID 1260 wrote to memory of 1132	1260	Explorer.EXE	18
PID 1260 wrote to memory of 1192	1260	Explorer.EXE	19
PID 1260 wrote to memory of 1564	1260	Explorer.EXE	29
PID 1260 wrote to memory of 284	1260	Explorer.EXE	30
PID 1260 wrote to memory of 284	1260	Explorer.EXE	30

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1132

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1192

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
  "C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
    C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:868
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS9522~1.BAT"
      4⤵
      Deletes itself
      PID:1564

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "18384591207301281711714364056707320209-470974169-638785921831421913-903701249"
1⤵
PID:284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms9522115.bat

Filesize
201B

MD5
9ca052fe0c4fa87d1e9fb9b89fc0d706

SHA1
74b8f3a675b69e89b845cd32511b40c0b6176051

SHA256
5dce8a686458ea629ceec9c57875886b0dee04fabbfec809c58b00cb3a181565

SHA512
371a68efea9896d802b301b4374887ab7c05ee5547efb983a4f5f1d16595d25a97d3ba63599fac03a3ff332d7ce2f40cb01e1a51c1385825098aceb55eb4f9da

Download Submit
memory/284-90-0x0000000000080000-0x0000000000097000-memory.dmp

Filesize
92KB

Download
memory/568-54-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download
memory/568-65-0x0000000000300000-0x0000000000304000-memory.dmp

Filesize
16KB

Download
memory/868-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/868-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/868-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/868-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/868-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/868-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/868-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/868-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1132-82-0x0000000037590000-0x00000000375A0000-memory.dmp

Filesize
64KB

Download
memory/1132-92-0x0000000001CD0000-0x0000000001CE7000-memory.dmp

Filesize
92KB

Download
memory/1192-89-0x0000000037590000-0x00000000375A0000-memory.dmp

Filesize
64KB

Download
memory/1192-93-0x0000000001AC0000-0x0000000001AD7000-memory.dmp

Filesize
92KB

Download
memory/1260-76-0x0000000037590000-0x00000000375A0000-memory.dmp

Filesize
64KB

Download
memory/1260-72-0x00000000029F0000-0x0000000002A07000-memory.dmp

Filesize
92KB

Download
memory/1260-91-0x00000000029F0000-0x0000000002A07000-memory.dmp

Filesize
92KB

Download
memory/1564-81-0x0000000000150000-0x0000000000164000-memory.dmp

Filesize
80KB

Download
memory/1564-88-0x0000000000150000-0x0000000000164000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing