8f9a87642e60167e7e92118a0e0626e614819bb8610dd4b2ed34f7190d87df50

General

Target

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Size

164KB
MD5

744c74d17d06d1a57fde4eb674b658e5
SHA1

4db6ca64d8891bea93e4fef0e54753afefe2fc1f
SHA256

2c4ebda5b2fc4e138ac11f456cafc4fbdf81f557c1d27469da123a8a4bad7da4
SHA512

ca43f4e7d33d1192facb320d27dfda3519b5fe8c723baa79e9e71b87a677ea75577fb8bb3ae45365207c736ec1f7273ceed12de5725ff20005f172e77538decd
SSDEEP

3072:aLYWOECeWVKXdevckFFAn+jUkrKkO2oATT5o/2OWo:aLwxeSKXgckZBx3o4TWq

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

944 cmd.exe

pid	process
944	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\loibgjiv.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\loibgjiv.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

description	pid	process	target process
PID 892 set thread context of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exerechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exeExplorer.EXE

pid	process
892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1264 Explorer.EXE

pid	process
1264	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Token: SeDebugPrivilege	1264	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1264 Explorer.EXE
1264 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1264 Explorer.EXE
1264 Explorer.EXE

pid	process
1264	Explorer.EXE
1264	Explorer.EXE

pid	process
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

pid	process
892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1264 Explorer.EXE

pid	process
1264	Explorer.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exerechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exeExplorer.EXE

description	pid	process	target process
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 996 wrote to memory of 944	996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 996 wrote to memory of 944	996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 996 wrote to memory of 944	996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 996 wrote to memory of 944	996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 996 wrote to memory of 1264	996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	Explorer.EXE
PID 1264 wrote to memory of 1124	1264	Explorer.EXE	taskhost.exe
PID 1264 wrote to memory of 1124	1264	Explorer.EXE	taskhost.exe
PID 1264 wrote to memory of 1176	1264	Explorer.EXE	Dwm.exe
PID 1264 wrote to memory of 944	1264	Explorer.EXE	cmd.exe
PID 1264 wrote to memory of 944	1264	Explorer.EXE	cmd.exe

C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
"C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892

C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS7981~1.BAT"
3⤵
- Deletes itself
PID:944

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1176

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1124

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms7981266.bat
Filesize
201B

MD5
49335464bb1d1c6236ab459873dfa258

SHA1
2b7b177283d7aae1b1732512deb0a050cd209bef

SHA256
4e884df3327dae1f4550958bd07e8211be2b819b8d4f263f67e6a0bbc15c545c

SHA512
7b996eaab9220e49bae9461ef3d6e38123c798398439378645a69351339201747d6f5c425f70797b9ad30d2d1bcd712b5326e5e2bec703419d71bdfceca27620

Download Submit
memory/892-65-0x00000000002C0000-0x00000000002C4000-memory.dmp

Filesize
16KB

Download
memory/892-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/944-83-0x00000000000C0000-0x00000000000D4000-memory.dmp

Filesize
80KB

Download
memory/944-71-0x0000000000000000-mapping.dmp

Download
memory/996-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/996-64-0x00000000004010C0-mapping.dmp

Download
memory/996-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/996-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/996-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/996-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/996-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/996-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/996-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1124-86-0x00000000379C0000-0x00000000379D0000-memory.dmp

Filesize
64KB

Download
memory/1124-87-0x00000000379C0000-0x00000000379D0000-memory.dmp

Filesize
64KB

Download
memory/1124-91-0x0000000001DE0000-0x0000000001DF7000-memory.dmp

Filesize
92KB

Download
memory/1124-90-0x0000000001E80000-0x0000000001E97000-memory.dmp

Filesize
92KB

Download
memory/1176-92-0x0000000001AD0000-0x0000000001AE7000-memory.dmp

Filesize
92KB

Download
memory/1176-88-0x00000000379C0000-0x00000000379D0000-memory.dmp

Filesize
64KB

Download
memory/1264-72-0x0000000002B50000-0x0000000002B67000-memory.dmp

Filesize
92KB

Download
memory/1264-89-0x0000000002B50000-0x0000000002B67000-memory.dmp

Filesize
92KB

Download
memory/1264-76-0x00000000379C0000-0x00000000379D0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads