8d6be2e92896af3b21d24c5db4e168f6249bf27276fa0b6d6dc5e4d2b50552db

Analysis

max time kernel
4s
max time network
7s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Size

168KB
MD5

03bbe5696e292a27becc2197f1024a16
SHA1

59802f9b918bed69eaf113f1ab24698bd46392d0
SHA256

6452bb100340136bacfe46a6c14d211f409144fe0919768fde8feb52536583a5
SHA512

36b8b3f166e87aa9c34401159dc16d0f757d1750a66bfe580e754677c59666c000a8c92484dec025ab8ec379096e24271435f25fb9e507a36d31bfc70f1bd270
SSDEEP

3072:2dLyZlwEyKcoO29Y5eCPN2bViTphJP12EFs+NLVgu2TVAOWX:oLaw7F3CY5e+CVi/yEXlVh2hk

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

description	pid	process	target process
PID 5096 set thread context of 2176	5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

pid	process
5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

pid	process
5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exerechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

description	pid	process	target process
PID 5096 wrote to memory of 2176	5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 5096 wrote to memory of 2176	5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 5096 wrote to memory of 2176	5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 5096 wrote to memory of 2176	5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 5096 wrote to memory of 2176	5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 5096 wrote to memory of 2176	5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 5096 wrote to memory of 2176	5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 5096 wrote to memory of 2176	5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 5096 wrote to memory of 2176	5096	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 2176 wrote to memory of 3792	2176	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 2176 wrote to memory of 3792	2176	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 2176 wrote to memory of 3792	2176	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
"C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096

C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS7162~1.BAT"
3⤵
PID:3792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2152-138-0x00007FFF1ACB0000-0x00007FFF1ACC0000-memory.dmp

Filesize
64KB

Download
memory/2176-132-0x0000000000000000-mapping.dmp

Download
memory/2176-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2176-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3792-137-0x0000000000000000-mapping.dmp

Download
memory/5096-134-0x0000000000B00000-0x0000000000B04000-memory.dmp

Filesize
16KB

Download