Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 03:50
Static task
static1
Behavioral task
behavioral1
Sample
rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
Resource
win10v2004-20220812-en
General
-
Target
rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
-
Size
180KB
-
MD5
f96874ad23fde2f0b3af2af1565beb73
-
SHA1
16e63fa7df0f2e8964d2e9cf2541b9ccd5c31106
-
SHA256
0ed91af7f5dd71ee724ef0bddaae43bdd10721fa21f2b226f69f3156085126fc
-
SHA512
e5c621a7bd62832ba331b2d0ee40d72e81d9a6892a662ded20c1c23e56b553b829f1691293728b1a8d190c6dd3c0dfdccfe77551ebe2bf7e3220d411c77e803d
-
SSDEEP
3072:t1ezQdDuZph4fWy6c3v40y+rzqVCr+YARsI6u2t4Y9sBG0hac0v2D+:t1eUNuFIdt3vTrz1r+R7F2t4pUO
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1460 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtntglna.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\gtntglna.exe\"" Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exeExplorer.EXEpid process 1980 rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe 1980 rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE 1324 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1980 rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe Token: SeDebugPrivilege 1324 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1324 Explorer.EXE 1324 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1324 Explorer.EXE 1324 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1324 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exeExplorer.EXEdescription pid process target process PID 1980 wrote to memory of 1460 1980 rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe cmd.exe PID 1980 wrote to memory of 1460 1980 rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe cmd.exe PID 1980 wrote to memory of 1460 1980 rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe cmd.exe PID 1980 wrote to memory of 1460 1980 rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe cmd.exe PID 1980 wrote to memory of 1324 1980 rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe Explorer.EXE PID 1324 wrote to memory of 1192 1324 Explorer.EXE taskhost.exe PID 1324 wrote to memory of 1272 1324 Explorer.EXE Dwm.exe PID 1324 wrote to memory of 1980 1324 Explorer.EXE rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe PID 1324 wrote to memory of 1460 1324 Explorer.EXE cmd.exe PID 1324 wrote to memory of 1836 1324 Explorer.EXE conhost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe"C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6980~1.BAT"3⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "927395474-643965343421740816-143076663893125367185724251079534671258182628"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms6980848.batFilesize
201B
MD5ba2a6572c1f31511be28d9e1d651d87e
SHA1807815ca2f11089a3bdd50f0748e200919100eec
SHA25689f799c42eea0ba91c83a7b18562dba2d480f70f5893eabd8b6b1be9cec20f5a
SHA512115c8f0cf0ff48e652e7392f343779229449797247fbb4b2fc3b019a211a20e33bf722f9c641556eb6dfcf11b5bba0c66dd6024c7b01117ceac23ead58ad5eed
-
memory/1192-79-0x00000000003A0000-0x00000000003B7000-memory.dmpFilesize
92KB
-
memory/1192-67-0x0000000036FD0000-0x0000000036FE0000-memory.dmpFilesize
64KB
-
memory/1272-78-0x00000000002A0000-0x00000000002B7000-memory.dmpFilesize
92KB
-
memory/1272-72-0x0000000036FD0000-0x0000000036FE0000-memory.dmpFilesize
64KB
-
memory/1324-56-0x00000000021E0000-0x00000000021F7000-memory.dmpFilesize
92KB
-
memory/1324-58-0x0000000036FD0000-0x0000000036FE0000-memory.dmpFilesize
64KB
-
memory/1324-80-0x00000000021E0000-0x00000000021F7000-memory.dmpFilesize
92KB
-
memory/1460-76-0x00000000001C0000-0x00000000001D4000-memory.dmpFilesize
80KB
-
memory/1460-55-0x0000000000000000-mapping.dmp
-
memory/1460-74-0x0000000037180000-0x0000000037190000-memory.dmpFilesize
64KB
-
memory/1836-77-0x00000000000C0000-0x00000000000D7000-memory.dmpFilesize
92KB
-
memory/1836-75-0x0000000036FD0000-0x0000000036FE0000-memory.dmpFilesize
64KB
-
memory/1980-54-0x0000000075981000-0x0000000075983000-memory.dmpFilesize
8KB
-
memory/1980-65-0x00000000003D0000-0x00000000003E4000-memory.dmpFilesize
80KB
-
memory/1980-61-0x00000000002A0000-0x00000000002AD000-memory.dmpFilesize
52KB
-
memory/1980-63-0x0000000001130000-0x0000000001165000-memory.dmpFilesize
212KB