bc673b404b7f565bef5ce95d5870ba8703558f626724738957b944ef50d24ac1

General

Target

ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
Size

204KB
MD5

d482374e81b35c6b2bba6ee71315e382
SHA1

c20efcbc5aa311b5ffb7fc18c97fccad043c22dc
SHA256

cd3666f7ddcc5c720f86402b0b6fb2c81fe21827b0a4eecbba1961b896b7590d
SHA512

cca3c24eac21967a98673ef921899373dc931b05318f0111fefdcadc84db193828dde56e9c47eb4a24877fb1c005fba8b04aa9a21b47751b79d72dfbc90bbf84
SSDEEP

3072:2TNLneeBJ6hERwOPPB+vziPhtMCpPQKSXmLSScrE7SNZmZUNHs4j:+LnehdQgWDMCtb5LSSc/2Z4j

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1780	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\engtvbbi.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\engtvbbi.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1044 set thread context of 1028	1044	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	27

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1044	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
1028	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
1028	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
1232	Explorer.EXE
1232	Explorer.EXE
1232	Explorer.EXE
1232	Explorer.EXE
1232	Explorer.EXE
1232	Explorer.EXE
1232	Explorer.EXE
1232	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1232	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
Token: SeDebugPrivilege	1232	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1232	Explorer.EXE
1232	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1232	Explorer.EXE
1232	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1044	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
1044	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1232	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1028	1044	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	27
PID 1044 wrote to memory of 1028	1044	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	27
PID 1044 wrote to memory of 1028	1044	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	27
PID 1044 wrote to memory of 1028	1044	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	27
PID 1044 wrote to memory of 1028	1044	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	27
PID 1044 wrote to memory of 1028	1044	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	27
PID 1044 wrote to memory of 1028	1044	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	27
PID 1044 wrote to memory of 1028	1044	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	27
PID 1044 wrote to memory of 1028	1044	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	27
PID 1044 wrote to memory of 1028	1044	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	27
PID 1028 wrote to memory of 1780	1028	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	28
PID 1028 wrote to memory of 1780	1028	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	28
PID 1028 wrote to memory of 1780	1028	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	28
PID 1028 wrote to memory of 1780	1028	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	28
PID 1028 wrote to memory of 1232	1028	ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe	11
PID 1232 wrote to memory of 1124	1232	Explorer.EXE	5
PID 1232 wrote to memory of 1124	1232	Explorer.EXE	5
PID 1232 wrote to memory of 1180	1232	Explorer.EXE	12

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1124

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
  "C:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
    C:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_december_2014_8320002103_12_01_910238002_1_9_3_7_001_002.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS5655~1.BAT"
      4⤵
      Deletes itself
      PID:1780

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms5655697.bat

Filesize
201B

MD5
23ada95bd9e4f2f6c95b69b5b7cd4021

SHA1
b13d41b6e06ae3a97149fde58ee00e0967ef4911

SHA256
7ce50e2f2f53c9b04bc40e36a05c68adb03b3128de4d6343ded2e6bbfe3e6ffe

SHA512
6276d8ba4483c01b473c1dfcb30e90aabb7d19ea3a02c5bb0c54e3838cb86a812250b07ac30b8f5f56bd293c2802ebdae625dfa51fa848d6eb81aca4ebb52160

Download Submit
memory/1028-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1028-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1028-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1028-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1028-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1028-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1028-69-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1028-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1028-75-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1044-65-0x0000000000290000-0x0000000000294000-memory.dmp

Filesize
16KB

Download
memory/1044-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1124-85-0x0000000037490000-0x00000000374A0000-memory.dmp

Filesize
64KB

Download
memory/1124-90-0x0000000000220000-0x0000000000237000-memory.dmp

Filesize
92KB

Download
memory/1124-88-0x0000000000240000-0x0000000000257000-memory.dmp

Filesize
92KB

Download
memory/1124-84-0x0000000037490000-0x00000000374A0000-memory.dmp

Filesize
64KB

Download
memory/1180-86-0x0000000037490000-0x00000000374A0000-memory.dmp

Filesize
64KB

Download
memory/1180-89-0x0000000001C30000-0x0000000001C47000-memory.dmp

Filesize
92KB

Download
memory/1232-87-0x00000000025E0000-0x00000000025F7000-memory.dmp

Filesize
92KB

Download
memory/1232-76-0x0000000037490000-0x00000000374A0000-memory.dmp

Filesize
64KB

Download
memory/1232-73-0x00000000025E0000-0x00000000025F7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing