24875643510186345f6c53573817cb955ee32144bc3510db8120b51c44803c53

General

Target

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
Size

168KB
MD5

03bbe5696e292a27becc2197f1024a16
SHA1

59802f9b918bed69eaf113f1ab24698bd46392d0
SHA256

6452bb100340136bacfe46a6c14d211f409144fe0919768fde8feb52536583a5
SHA512

36b8b3f166e87aa9c34401159dc16d0f757d1750a66bfe580e754677c59666c000a8c92484dec025ab8ec379096e24271435f25fb9e507a36d31bfc70f1bd270
SSDEEP

3072:2dLyZlwEyKcoO29Y5eCPN2bViTphJP12EFs+NLVgu2TVAOWX:oLaw7F3CY5e+CVi/yEXlVh2hk

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1904 cmd.exe

pid	process
1904	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

description	pid	process	target process
PID 620 set thread context of 856	620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeonline_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeExplorer.EXE

pid	process
620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
856	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
856	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1192 Explorer.EXE

pid	process
1192	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	856	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
Token: SeDebugPrivilege	1192	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1192 Explorer.EXE
1192 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1192 Explorer.EXE
1192 Explorer.EXE

pid	process
1192	Explorer.EXE
1192	Explorer.EXE

pid	process
1192	Explorer.EXE
1192	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

pid	process
620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1192 Explorer.EXE

pid	process
1192	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeonline_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeExplorer.EXE

description	pid	process	target process
PID 620 wrote to memory of 856	620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 620 wrote to memory of 856	620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 620 wrote to memory of 856	620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 620 wrote to memory of 856	620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 620 wrote to memory of 856	620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 620 wrote to memory of 856	620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 620 wrote to memory of 856	620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 620 wrote to memory of 856	620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 620 wrote to memory of 856	620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 620 wrote to memory of 856	620	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 856 wrote to memory of 1904	856	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 856 wrote to memory of 1904	856	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 856 wrote to memory of 1904	856	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 856 wrote to memory of 1904	856	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 856 wrote to memory of 1192	856	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	Explorer.EXE
PID 1192 wrote to memory of 1108	1192	Explorer.EXE	taskhost.exe
PID 1192 wrote to memory of 1168	1192	Explorer.EXE	Dwm.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1108

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1168

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1192

C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
"C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620

C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS9068~1.BAT"
4⤵
- Deletes itself
PID:1904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms9068152.bat
Filesize
201B

MD5
8d0096786d5212d8dabe16598a89389d

SHA1
4f3fcd56270ef5a6a8e3d445ed67ccb47ce9323c

SHA256
d1a260a4492cf5cb51025a059bd841c01705e0315994bf87b2b8ea53d1da4613

SHA512
6dde33163b3d3285def9628879b277b5aa02605940a4dae3fd4087b2a47f6b78afd04b78ec4c2752d16af7cbccaf9b9f7abba73d1bfc72b413682a5e4dd81059

Download Submit
memory/620-65-0x0000000000250000-0x0000000000254000-memory.dmp

Filesize
16KB

Download
memory/620-54-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/856-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/856-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/856-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/856-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/856-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/856-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/856-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/856-64-0x00000000004010C0-mapping.dmp

Download
memory/856-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1108-80-0x0000000037AF0000-0x0000000037B00000-memory.dmp

Filesize
64KB

Download
memory/1108-84-0x00000000001B0000-0x00000000001C7000-memory.dmp

Filesize
92KB

Download
memory/1168-82-0x0000000037AF0000-0x0000000037B00000-memory.dmp

Filesize
64KB

Download
memory/1168-85-0x0000000000120000-0x0000000000137000-memory.dmp

Filesize
92KB

Download
memory/1192-72-0x0000000002A10000-0x0000000002A27000-memory.dmp

Filesize
92KB

Download
memory/1192-75-0x0000000037AF0000-0x0000000037B00000-memory.dmp

Filesize
64KB

Download
memory/1192-83-0x0000000002A10000-0x0000000002A27000-memory.dmp

Filesize
92KB

Download
memory/1904-71-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads