8f9a87642e60167e7e92118a0e0626e614819bb8610dd4b2ed34f7190d87df50

General

Target

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Size

164KB
MD5

744c74d17d06d1a57fde4eb674b658e5
SHA1

4db6ca64d8891bea93e4fef0e54753afefe2fc1f
SHA256

2c4ebda5b2fc4e138ac11f456cafc4fbdf81f557c1d27469da123a8a4bad7da4
SHA512

ca43f4e7d33d1192facb320d27dfda3519b5fe8c723baa79e9e71b87a677ea75577fb8bb3ae45365207c736ec1f7273ceed12de5725ff20005f172e77538decd
SSDEEP

3072:aLYWOECeWVKXdevckFFAn+jUkrKkO2oATT5o/2OWo:aLwxeSKXgckZBx3o4TWq

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
944	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\loibgjiv.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\loibgjiv.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 892 set thread context of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1264	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Token: SeDebugPrivilege	1264	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1264	Explorer.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 892 wrote to memory of 996	892	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	27
PID 996 wrote to memory of 944	996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 996 wrote to memory of 944	996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 996 wrote to memory of 944	996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 996 wrote to memory of 944	996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 996 wrote to memory of 1264	996	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	15
PID 1264 wrote to memory of 1124	1264	Explorer.EXE	17
PID 1264 wrote to memory of 1124	1264	Explorer.EXE	17
PID 1264 wrote to memory of 1176	1264	Explorer.EXE	16
PID 1264 wrote to memory of 944	1264	Explorer.EXE	28
PID 1264 wrote to memory of 944	1264	Explorer.EXE	28

C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
"C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892
- C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
  C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS7981~1.BAT"
    3⤵
    - Deletes itself
    PID:944

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1176

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms7981266.bat

Filesize
201B

MD5
49335464bb1d1c6236ab459873dfa258

SHA1
2b7b177283d7aae1b1732512deb0a050cd209bef

SHA256
4e884df3327dae1f4550958bd07e8211be2b819b8d4f263f67e6a0bbc15c545c

SHA512
7b996eaab9220e49bae9461ef3d6e38123c798398439378645a69351339201747d6f5c425f70797b9ad30d2d1bcd712b5326e5e2bec703419d71bdfceca27620

Download Submit
memory/892-65-0x00000000002C0000-0x00000000002C4000-memory.dmp

Filesize
16KB

Download
memory/892-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/944-83-0x00000000000C0000-0x00000000000D4000-memory.dmp

Filesize
80KB

Download
memory/996-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/996-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/996-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/996-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/996-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/996-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/996-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/996-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1124-86-0x00000000379C0000-0x00000000379D0000-memory.dmp

Filesize
64KB

Download
memory/1124-87-0x00000000379C0000-0x00000000379D0000-memory.dmp

Filesize
64KB

Download
memory/1124-91-0x0000000001DE0000-0x0000000001DF7000-memory.dmp

Filesize
92KB

Download
memory/1124-90-0x0000000001E80000-0x0000000001E97000-memory.dmp

Filesize
92KB

Download
memory/1176-88-0x00000000379C0000-0x00000000379D0000-memory.dmp

Filesize
64KB

Download
memory/1176-92-0x0000000001AD0000-0x0000000001AE7000-memory.dmp

Filesize
92KB

Download
memory/1264-72-0x0000000002B50000-0x0000000002B67000-memory.dmp

Filesize
92KB

Download
memory/1264-76-0x00000000379C0000-0x00000000379D0000-memory.dmp

Filesize
64KB

Download
memory/1264-89-0x0000000002B50000-0x0000000002B67000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing