0cc3f3d2b9c0054c0f3925fce5920d94bb02db801a24820d412217943554320f

General

Target

rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
Size

168KB
MD5

03bbe5696e292a27becc2197f1024a16
SHA1

59802f9b918bed69eaf113f1ab24698bd46392d0
SHA256

6452bb100340136bacfe46a6c14d211f409144fe0919768fde8feb52536583a5
SHA512

36b8b3f166e87aa9c34401159dc16d0f757d1750a66bfe580e754677c59666c000a8c92484dec025ab8ec379096e24271435f25fb9e507a36d31bfc70f1bd270
SSDEEP

3072:2dLyZlwEyKcoO29Y5eCPN2bViTphJP12EFs+NLVgu2TVAOWX:oLaw7F3CY5e+CVi/yEXlVh2hk

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe

description	pid	process	target process
PID 4684 set thread context of 4260	4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exerechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe

pid	process
4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
4260	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
4260	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe

description pid process

Token: SeDebugPrivilege 4260 rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe

description	pid	process
Token: SeDebugPrivilege	4260	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe

pid	process
4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exerechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe

description	pid	process	target process
PID 4684 wrote to memory of 4260	4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
PID 4684 wrote to memory of 4260	4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
PID 4684 wrote to memory of 4260	4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
PID 4684 wrote to memory of 4260	4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
PID 4684 wrote to memory of 4260	4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
PID 4684 wrote to memory of 4260	4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
PID 4684 wrote to memory of 4260	4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
PID 4684 wrote to memory of 4260	4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
PID 4684 wrote to memory of 4260	4684	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
PID 4260 wrote to memory of 3940	4260	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	cmd.exe
PID 4260 wrote to memory of 3940	4260	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	cmd.exe
PID 4260 wrote to memory of 3940	4260	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	cmd.exe
PID 4260 wrote to memory of 2640	4260	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2640

C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
"C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684

C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS4499~1.BAT"
4⤵
PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2640-139-0x00007FF8314D0000-0x00007FF8314E0000-memory.dmp

Filesize
64KB

Download
memory/3940-138-0x0000000000000000-mapping.dmp

Download
memory/4260-132-0x0000000000000000-mapping.dmp

Download
memory/4260-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4260-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4260-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4260-140-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4684-134-0x0000000000670000-0x0000000000674000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads