Analysis
-
max time kernel
202s -
max time network
210s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:01
Static task
static1
Behavioral task
behavioral1
Sample
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
Resource
win10v2004-20221111-en
General
-
Target
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
-
Size
148KB
-
MD5
bb6eaa3caf122030e276ddb20790e5e5
-
SHA1
050019c2864790aa5f0ac4fa6d2e1a65eb59cd70
-
SHA256
bba5332c6f0d44bc3f2935842dfbcc051f3edb1b7f186a94c665271ccca13755
-
SHA512
1290ae818f8a64288848fd6fc1e721edb96b4cd5b0991b1f7d10602198ddefdfcdd1f8b3b7610594432581752f14cc60514cd57930c636a4b8a714a18f7d4d7d
-
SSDEEP
3072:cIjIB3k5uMfRUL9glXFQuMlgSLLPr6s6THgFWP27:n/uUa+QuMumqAFWP6
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1496 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\loibgjiv.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\loibgjiv.exe\"" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exedescription pid process target process PID 2020 set thread context of 556 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeInformationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeExplorer.EXEpid process 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe 556 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe 556 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 556 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Token: SeDebugPrivilege 1204 Explorer.EXE Token: SeShutdownPrivilege 1204 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exepid process 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeInformationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeExplorer.EXEdescription pid process target process PID 2020 wrote to memory of 556 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 2020 wrote to memory of 556 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 2020 wrote to memory of 556 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 2020 wrote to memory of 556 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 2020 wrote to memory of 556 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 2020 wrote to memory of 556 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 2020 wrote to memory of 556 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 2020 wrote to memory of 556 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 2020 wrote to memory of 556 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 2020 wrote to memory of 556 2020 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe PID 556 wrote to memory of 1496 556 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe cmd.exe PID 556 wrote to memory of 1496 556 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe cmd.exe PID 556 wrote to memory of 1496 556 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe cmd.exe PID 556 wrote to memory of 1496 556 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe cmd.exe PID 556 wrote to memory of 1204 556 Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe Explorer.EXE PID 1204 wrote to memory of 1120 1204 Explorer.EXE taskhost.exe PID 1204 wrote to memory of 1120 1204 Explorer.EXE taskhost.exe PID 1204 wrote to memory of 1172 1204 Explorer.EXE Dwm.exe PID 1204 wrote to memory of 1172 1204 Explorer.EXE Dwm.exe PID 1204 wrote to memory of 1496 1204 Explorer.EXE cmd.exe PID 1204 wrote to memory of 1304 1204 Explorer.EXE conhost.exe PID 1204 wrote to memory of 1304 1204 Explorer.EXE conhost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe"C:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exeC:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS3818~1.BAT"4⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-8309846612018439535-203513228-1360198138103871423218140397801293265976861739817"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms3818398.batFilesize
201B
MD575934aef3fefd9124923ada5ef096b94
SHA1e5130898cf96040213fe878294d59f42b87c5380
SHA256c5db12f4181403db8c4c06829e4d1dad310e66f074e5d850b3c6199283bf2bee
SHA5123e5bda1e570811a73f63c8f89d2082bc1c7002b5bf8ce0542b9b3a6942521cbc8d02bdaf878f504ea1b783eb854c8c743b5d1e17b6ed0f87767b4a16dcfb2ba6
-
memory/556-75-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/556-55-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/556-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/556-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/556-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/556-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/556-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/556-64-0x00000000004010C0-mapping.dmp
-
memory/556-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1120-83-0x0000000037830000-0x0000000037840000-memory.dmpFilesize
64KB
-
memory/1120-98-0x00000000002C0000-0x00000000002D7000-memory.dmpFilesize
92KB
-
memory/1120-86-0x0000000037830000-0x0000000037840000-memory.dmpFilesize
64KB
-
memory/1120-100-0x0000000000290000-0x00000000002A7000-memory.dmpFilesize
92KB
-
memory/1172-102-0x0000000001B60000-0x0000000001B77000-memory.dmpFilesize
92KB
-
memory/1172-87-0x0000000037830000-0x0000000037840000-memory.dmpFilesize
64KB
-
memory/1172-91-0x0000000037830000-0x0000000037840000-memory.dmpFilesize
64KB
-
memory/1172-101-0x0000000001E80000-0x0000000001E97000-memory.dmpFilesize
92KB
-
memory/1204-74-0x0000000037830000-0x0000000037840000-memory.dmpFilesize
64KB
-
memory/1204-72-0x00000000021F0000-0x0000000002207000-memory.dmpFilesize
92KB
-
memory/1204-99-0x00000000021F0000-0x0000000002207000-memory.dmpFilesize
92KB
-
memory/1304-97-0x0000000000090000-0x00000000000A7000-memory.dmpFilesize
92KB
-
memory/1496-85-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/1496-96-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/1496-95-0x00000000379E0000-0x00000000379F0000-memory.dmpFilesize
64KB
-
memory/1496-71-0x0000000000000000-mapping.dmp
-
memory/2020-65-0x00000000003F0000-0x00000000003F4000-memory.dmpFilesize
16KB
-
memory/2020-54-0x0000000076531000-0x0000000076533000-memory.dmpFilesize
8KB