0a4e185a7b4a46ecd1a305b1dada207f845bd8a252b3458f9c4f722c82653611

General

Target

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Size

196KB
MD5

03c97952e19ce93941404ef9a3a935f5
SHA1

ec7edb6a0b5f14c7017ba645e269c8598633e384
SHA256

e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0
SHA512

713b638f2f4f0870798ae66e14a81de302612b8aec3dc4cb1ce169b6df9be3aa89746dae4b31b0cd98ada46bd0fda3e42c8b4992c04ef6635bd112a137339f7f
SSDEEP

3072:9udusODvGZVHhX1drkr3k1qusMrf/Kf2DWJEi/i0D2D7oyCT8nVn1QJsYvVnGd+z:59+phXzpsML/E2DH0yDTV13Y5z

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

112 cmd.exe

pid	process
112	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtntglna.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\gtntglna.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

description	pid	process	target process
PID 1480 set thread context of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exerechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exeExplorer.EXE

pid	process
1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1416	Explorer.EXE
1416	Explorer.EXE
1416	Explorer.EXE
1416	Explorer.EXE
1416	Explorer.EXE
1416	Explorer.EXE
1416	Explorer.EXE
1416	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Token: SeDebugPrivilege	1416	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1416 Explorer.EXE
1416 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1416 Explorer.EXE
1416 Explorer.EXE

pid	process
1416	Explorer.EXE
1416	Explorer.EXE

pid	process
1416	Explorer.EXE
1416	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

pid	process
1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1416 Explorer.EXE

pid	process
1416	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exerechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exeExplorer.EXE

description	pid	process	target process
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1480 wrote to memory of 1628	1480	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1628 wrote to memory of 112	1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 1628 wrote to memory of 112	1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 1628 wrote to memory of 112	1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 1628 wrote to memory of 112	1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 1628 wrote to memory of 1416	1628	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	Explorer.EXE
PID 1416 wrote to memory of 1228	1416	Explorer.EXE	taskhost.exe
PID 1416 wrote to memory of 1368	1416	Explorer.EXE	Dwm.exe
PID 1416 wrote to memory of 1368	1416	Explorer.EXE	Dwm.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1228

C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
"C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480

C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS4471~1.BAT"
3⤵
- Deletes itself
PID:112

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms4471165.bat
Filesize
201B

MD5
89fc3adf7a46f495b5b4ec7ead7cf066

SHA1
09e5dbfa7dd9f30eb2c4bb5bdd09d56fe9dd0503

SHA256
cb35a69bb57a64ab6271fdcdac1bc14e4027083ca36eb679996d249bdc3098d3

SHA512
a3466a0328815f075d68b6ed6521e9b6a3de3d193703ba724b08e8a886bf90a44e91446cff416c3c6c5dd4dc8c4c6a9a67d44a79f6d2598aa436ffd912026599

Download Submit
memory/112-71-0x0000000000000000-mapping.dmp

Download
memory/1228-82-0x0000000037150000-0x0000000037160000-memory.dmp

Filesize
64KB

Download
memory/1228-87-0x0000000000330000-0x0000000000347000-memory.dmp

Filesize
92KB

Download
memory/1368-89-0x00000000001A0000-0x00000000001B7000-memory.dmp

Filesize
92KB

Download
memory/1368-88-0x00000000001C0000-0x00000000001D7000-memory.dmp

Filesize
92KB

Download
memory/1368-85-0x0000000037150000-0x0000000037160000-memory.dmp

Filesize
64KB

Download
memory/1368-84-0x0000000037150000-0x0000000037160000-memory.dmp

Filesize
64KB

Download
memory/1416-72-0x00000000021E0000-0x00000000021F7000-memory.dmp

Filesize
92KB

Download
memory/1416-86-0x00000000021E0000-0x00000000021F7000-memory.dmp

Filesize
92KB

Download
memory/1416-76-0x0000000037150000-0x0000000037160000-memory.dmp

Filesize
64KB

Download
memory/1480-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/1480-65-0x00000000002C0000-0x00000000002C4000-memory.dmp

Filesize
16KB

Download
memory/1628-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1628-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1628-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1628-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1628-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1628-64-0x00000000004010C0-mapping.dmp

Download
memory/1628-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1628-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1628-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads