351fa45793110686ac90dd13a344aa12f073dc51cb5a46e40f09069e7b503871

Analysis

max time kernel
3s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Size

196KB
MD5

03c97952e19ce93941404ef9a3a935f5
SHA1

ec7edb6a0b5f14c7017ba645e269c8598633e384
SHA256

e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0
SHA512

713b638f2f4f0870798ae66e14a81de302612b8aec3dc4cb1ce169b6df9be3aa89746dae4b31b0cd98ada46bd0fda3e42c8b4992c04ef6635bd112a137339f7f
SSDEEP

3072:9udusODvGZVHhX1drkr3k1qusMrf/Kf2DWJEi/i0D2D7oyCT8nVn1QJsYvVnGd+z:59+phXzpsML/E2DH0yDTV13Y5z

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1560 set thread context of 4156	1560	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1560	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1560	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
4156	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
4156	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4156	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1560	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1560	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 4156	1560	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	84
PID 1560 wrote to memory of 4156	1560	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	84
PID 1560 wrote to memory of 4156	1560	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	84
PID 1560 wrote to memory of 4156	1560	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	84
PID 1560 wrote to memory of 4156	1560	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	84
PID 1560 wrote to memory of 4156	1560	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	84
PID 1560 wrote to memory of 4156	1560	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	84
PID 1560 wrote to memory of 4156	1560	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	84
PID 1560 wrote to memory of 4156	1560	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	84
PID 4156 wrote to memory of 5088	4156	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	85
PID 4156 wrote to memory of 5088	4156	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	85
PID 4156 wrote to memory of 5088	4156	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	85
PID 4156 wrote to memory of 2584	4156	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	49

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2584
- C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
  "C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
    C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6188~1.BAT"
      4⤵
      PID:5088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-134-0x0000000002380000-0x0000000002384000-memory.dmp

Filesize
16KB

Download
memory/4156-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4156-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download