351fa45793110686ac90dd13a344aa12f073dc51cb5a46e40f09069e7b503871

General

Target

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Size

196KB
MD5

03c97952e19ce93941404ef9a3a935f5
SHA1

ec7edb6a0b5f14c7017ba645e269c8598633e384
SHA256

e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0
SHA512

713b638f2f4f0870798ae66e14a81de302612b8aec3dc4cb1ce169b6df9be3aa89746dae4b31b0cd98ada46bd0fda3e42c8b4992c04ef6635bd112a137339f7f
SSDEEP

3072:9udusODvGZVHhX1drkr3k1qusMrf/Kf2DWJEi/i0D2D7oyCT8nVn1QJsYvVnGd+z:59+phXzpsML/E2DH0yDTV13Y5z

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
516	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\loibgjiv.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\loibgjiv.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1180 set thread context of 2044	1180	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1180	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
2044	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
2044	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1252	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Token: SeDebugPrivilege	1252	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1252	Explorer.EXE
1252	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1252	Explorer.EXE
1252	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1180	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1180	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1252	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2044	1180	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1180 wrote to memory of 2044	1180	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1180 wrote to memory of 2044	1180	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1180 wrote to memory of 2044	1180	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1180 wrote to memory of 2044	1180	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1180 wrote to memory of 2044	1180	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1180 wrote to memory of 2044	1180	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1180 wrote to memory of 2044	1180	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1180 wrote to memory of 2044	1180	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1180 wrote to memory of 2044	1180	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 2044 wrote to memory of 516	2044	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	29
PID 2044 wrote to memory of 516	2044	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	29
PID 2044 wrote to memory of 516	2044	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	29
PID 2044 wrote to memory of 516	2044	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	29
PID 2044 wrote to memory of 1252	2044	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	15
PID 1252 wrote to memory of 1128	1252	Explorer.EXE	17
PID 1252 wrote to memory of 1188	1252	Explorer.EXE	16

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
  "C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
    C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ms525478.bat"
      4⤵
      Deletes itself
      PID:516

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1188

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms525478.bat

Filesize
201B

MD5
e53e3a02c7652682c261a7c216128761

SHA1
a6362e13e434c1440cbfe149e71fddec594244ec

SHA256
3b7f5929ca8223baf9ede3f6d07c84cf9ce9b4546ad39934129bed7d1b987742

SHA512
5698a8c9638943cd01d866950d505967eddb89fdfa694eebb8417704936bb2f5d4a93bddb169be594df6a85ffc43c3ac4349e3fa36d5662e51b2ee1c989f7726

Download Submit
memory/1128-84-0x0000000001D20000-0x0000000001D37000-memory.dmp

Filesize
92KB

Download
memory/1128-81-0x00000000372B0000-0x00000000372C0000-memory.dmp

Filesize
64KB

Download
memory/1180-66-0x00000000002D0000-0x00000000002D4000-memory.dmp

Filesize
16KB

Download
memory/1180-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1188-82-0x00000000372B0000-0x00000000372C0000-memory.dmp

Filesize
64KB

Download
memory/1188-85-0x0000000000120000-0x0000000000137000-memory.dmp

Filesize
92KB

Download
memory/1252-83-0x0000000002A70000-0x0000000002A87000-memory.dmp

Filesize
92KB

Download
memory/1252-75-0x00000000372B0000-0x00000000372C0000-memory.dmp

Filesize
64KB

Download
memory/1252-86-0x0000000002A70000-0x0000000002A87000-memory.dmp

Filesize
92KB

Download
memory/1252-87-0x000007FEF5E90000-0x000007FEF5FD3000-memory.dmp

Filesize
1.3MB

Download
memory/1252-73-0x0000000002A70000-0x0000000002A87000-memory.dmp

Filesize
92KB

Download
memory/1252-88-0x000007FF08F70000-0x000007FF08F7A000-memory.dmp

Filesize
40KB

Download
memory/2044-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2044-71-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2044-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2044-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2044-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2044-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2044-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2044-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing