2ac6bb0688f3073a1b4ae4906c7b6fc3a6928f3dd09b4cb2837f368407239ec3

General

Target

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
Size

196KB
MD5

03c97952e19ce93941404ef9a3a935f5
SHA1

ec7edb6a0b5f14c7017ba645e269c8598633e384
SHA256

e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0
SHA512

713b638f2f4f0870798ae66e14a81de302612b8aec3dc4cb1ce169b6df9be3aa89746dae4b31b0cd98ada46bd0fda3e42c8b4992c04ef6635bd112a137339f7f
SSDEEP

3072:9udusODvGZVHhX1drkr3k1qusMrf/Kf2DWJEi/i0D2D7oyCT8nVn1QJsYvVnGd+z:59+phXzpsML/E2DH0yDTV13Y5z

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tyevtgrk.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\tyevtgrk.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1236 set thread context of 5040	1236	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	83

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1236	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
1236	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
5040	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
5040	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
2600	Explorer.EXE
2600	Explorer.EXE
2600	Explorer.EXE
2600	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
Token: SeDebugPrivilege	2600	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1236	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
1236	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 5040	1236	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	83
PID 1236 wrote to memory of 5040	1236	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	83
PID 1236 wrote to memory of 5040	1236	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	83
PID 1236 wrote to memory of 5040	1236	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	83
PID 1236 wrote to memory of 5040	1236	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	83
PID 1236 wrote to memory of 5040	1236	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	83
PID 1236 wrote to memory of 5040	1236	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	83
PID 1236 wrote to memory of 5040	1236	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	83
PID 1236 wrote to memory of 5040	1236	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	83
PID 5040 wrote to memory of 3684	5040	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	84
PID 5040 wrote to memory of 3684	5040	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	84
PID 5040 wrote to memory of 3684	5040	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	84
PID 5040 wrote to memory of 2600	5040	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	39
PID 2600 wrote to memory of 2504	2600	Explorer.EXE	60
PID 2600 wrote to memory of 2516	2600	Explorer.EXE	59
PID 2600 wrote to memory of 2648	2600	Explorer.EXE	25
PID 2600 wrote to memory of 3104	2600	Explorer.EXE	37
PID 2600 wrote to memory of 3288	2600	Explorer.EXE	36

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2648

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3104

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
  "C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
    C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6074~1.BAT"
      4⤵
      PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2516

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2504-140-0x00007FFA01630000-0x00007FFA01640000-memory.dmp

Filesize
64KB

Download
memory/2600-139-0x00007FFA01630000-0x00007FFA01640000-memory.dmp

Filesize
64KB

Download
memory/5040-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5040-135-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5040-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5040-138-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing