f940a0acf5c3636ab2a4fdc6c0a0fc8b5a995a9d9088beed5eeeb2400f6e6302

Analysis

max time kernel
1s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
Size

196KB
MD5

fbc0d92f2f004428671631c74da80b4a
SHA1

f3f2933db39c9368885854fe522105414d73bc97
SHA256

f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176
SHA512

114c95ba4fc8823dfa9fbfa48eea0a8fc82edbafded6d29e2dbf4e77fd1328150db1541d6bc75df218a0e1ed70c5068930ccdc73dd95dba153151174178c4268
SSDEEP

3072:9udusODvGZVHhXwdrkr3k17awTtgXOahnEhHP+2lqKA8ZQ2VwDNNK8N58Tbntd+z:59+phXUHTS/hEhHW8G8ZpGhNzSuz

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe

description	pid	process	target process
PID 4900 set thread context of 4708	4900	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe

pid	process
4900	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
4900	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe

pid	process
4900	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
4900	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exerechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe

description	pid	process	target process
PID 4900 wrote to memory of 4708	4900	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
PID 4900 wrote to memory of 4708	4900	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
PID 4900 wrote to memory of 4708	4900	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
PID 4900 wrote to memory of 4708	4900	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
PID 4900 wrote to memory of 4708	4900	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
PID 4900 wrote to memory of 4708	4900	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
PID 4900 wrote to memory of 4708	4900	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
PID 4900 wrote to memory of 4708	4900	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
PID 4900 wrote to memory of 4708	4900	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
PID 4708 wrote to memory of 4800	4708	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe	cmd.exe
PID 4708 wrote to memory of 4800	4708	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe	cmd.exe
PID 4708 wrote to memory of 4800	4708	rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
"C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900

C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS7766~1.BAT"
3⤵
PID:4800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-138-0x00007FFD94C10000-0x00007FFD94C20000-memory.dmp

Filesize
64KB

Download
memory/4708-132-0x0000000000000000-mapping.dmp

Download
memory/4708-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4708-135-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4800-137-0x0000000000000000-mapping.dmp

Download
memory/4900-136-0x0000000002470000-0x0000000002474000-memory.dmp

Filesize
16KB

Download