7728699c0b82a030f1d3a623d6b817be1342e07637bf0044af3ecc1874737bb5

General

Target

2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
Size

172KB
MD5

c06b551f110824f92f7dd6e1e286338b
SHA1

b1451aabe43b20ddfe11ba08cda0716a47cf9fe6
SHA256

0fdc5af087744ec47f94d6d98b05c2f018a5b16bb097a7826f096bc6f7ffd92f
SHA512

4ae0cee0c75e61be40d33635b658d3ea0e074b7f4246a037da60ee6075906583b532236e41e1a3910684b9d8b71fecbcdadc1f9249bacf94b7726818cfbdc576
SSDEEP

3072:Lw0CwITzueTD9d0h06Up164tnYx82gGtjdkruyjn:LwYuzue/9+hpK8i4IGtj4

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ydinjphq.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ydinjphq.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3780 set thread context of 5096	3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	80

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
5096	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
5096	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
2724	Explorer.EXE
2724	Explorer.EXE
2724	Explorer.EXE
2724	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5096	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
Token: SeDebugPrivilege	2724	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 5096	3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	80
PID 3780 wrote to memory of 5096	3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	80
PID 3780 wrote to memory of 5096	3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	80
PID 3780 wrote to memory of 5096	3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	80
PID 3780 wrote to memory of 5096	3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	80
PID 3780 wrote to memory of 5096	3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	80
PID 3780 wrote to memory of 5096	3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	80
PID 3780 wrote to memory of 5096	3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	80
PID 3780 wrote to memory of 5096	3780	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	80
PID 5096 wrote to memory of 736	5096	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	81
PID 5096 wrote to memory of 736	5096	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	81
PID 5096 wrote to memory of 736	5096	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	81
PID 5096 wrote to memory of 2724	5096	2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe	53

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724
- C:\Users\Admin\AppData\Local\Temp\2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
  "C:\Users\Admin\AppData\Local\Temp\2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Users\Admin\AppData\Local\Temp\2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
    C:\Users\Admin\AppData\Local\Temp\2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS2426~1.BAT"
      4⤵
      PID:736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2724-139-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp

Filesize
64KB

Download
memory/3780-135-0x0000000001380000-0x0000000001384000-memory.dmp

Filesize
16KB

Download
memory/5096-134-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5096-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing