dc1975c45156e203c78d6a786df0149b10e68b3a690f6c60847de591bba7e834

Analysis

max time kernel
45s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
Size

164KB
MD5

e28d0c6fd513c1e54b9d94b8f88ccbf4
SHA1

c2a716460f2a187f068e7b832d128179a6f471a8
SHA256

a82767b36e38a43131ae34bd0e6b650398f8769b14c7e46343675287c7c2b422
SHA512

8dbbebed2c3bfe915a798d70815e0f4cd0a9b9035c98f8dc9e60d05f6efb9f1852ec2b7db47e503396c3206207c7289c1fb20a94a4dbfe267e9886e78ada60be
SSDEEP

3072:xJ/YG2oBFuE6q+I9jN/mdUMNqypfu6M5HPMW+dpkGj8qOD9Jf+yY:xJ/GoDVZOmMNRA6M2wqOD

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe

description	pid	process	target process
PID 2876 set thread context of 1456	2876	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe

pid	process
2876	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
2876	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe

pid	process
2876	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
2876	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exeihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe

description	pid	process	target process
PID 2876 wrote to memory of 1456	2876	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
PID 2876 wrote to memory of 1456	2876	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
PID 2876 wrote to memory of 1456	2876	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
PID 2876 wrote to memory of 1456	2876	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
PID 2876 wrote to memory of 1456	2876	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
PID 2876 wrote to memory of 1456	2876	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
PID 2876 wrote to memory of 1456	2876	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
PID 2876 wrote to memory of 1456	2876	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
PID 2876 wrote to memory of 1456	2876	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
PID 1456 wrote to memory of 1176	1456	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe	cmd.exe
PID 1456 wrote to memory of 1176	1456	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe	cmd.exe
PID 1456 wrote to memory of 1176	1456	ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
"C:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876

C:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
C:\Users\Admin\AppData\Local\Temp\ihre_telekom_mobilfunk_november_2014_00002930200_1_3_5_021090_82137_002_008_0004.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS5095~1.BAT"
3⤵
PID:1176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-137-0x0000000000000000-mapping.dmp

Download
memory/1456-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1456-132-0x0000000000000000-mapping.dmp

Download
memory/1456-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2876-134-0x0000000000650000-0x0000000000654000-memory.dmp

Filesize
16KB

Download