Analysis
- max time kernel
149s - max time network
153s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
24/11/2022, 04:26
General
- Target 1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe
- Size 172KB
- Sample221124-e2q5bscc3y
- SHA256 9c4853fb813000f747396db86faea3122e6f7395f600bef9b3bc5f6eea133a9b
Malware Config
Signatures
- Deletes itself 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Modifies registry class 14 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe"C:\Users\Admin\AppData\Local\Temp\1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exeC:\Users\Admin\AppData\Local\Temp\1_1_kundencenter_mobilfunk_2014_11_de_0209_0000328362_2761287_12_78_009_2876237820002.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS2476~1.BAT"4⤵
- Deletes itself
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
ms2476501.bat
memory/1136-87-0x0000000000310000-0x0000000000327000-memory.dmp
memory/1136-81-0x0000000037C70000-0x0000000037C80000-memory.dmp
memory/1236-89-0x00000000002A0000-0x00000000002B7000-memory.dmp
memory/1236-88-0x00000000002C0000-0x00000000002D7000-memory.dmp
memory/1236-85-0x0000000037C70000-0x0000000037C80000-memory.dmp
memory/1236-84-0x0000000037C70000-0x0000000037C80000-memory.dmp
memory/1288-72-0x00000000022F0000-0x0000000002307000-memory.dmp
memory/1288-90-0x00000000022F0000-0x0000000002307000-memory.dmp
memory/1288-86-0x00000000022F0000-0x0000000002307000-memory.dmp
memory/1288-75-0x0000000037C70000-0x0000000037C80000-memory.dmp
memory/1880-62-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1880-74-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1880-67-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1880-63-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1880-60-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1880-58-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1880-56-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1880-55-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1936-65-0x00000000002F0000-0x00000000002F4000-memory.dmp
memory/1936-54-0x0000000076DC1000-0x0000000076DC3000-memory.dmp