f6199ec69628681a3697265f813689c9122725eb88197a14d23193a28c2f8a8d

General

Target

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
Size

152KB
MD5

fa2f4d553195f26107bb14dd6bd1336f
SHA1

afc4088979a8de48bc06f921ffcddec35716b00c
SHA256

6d9e4d239cebe3c438a2c9a582afbc6d8d06f45fc5fd00b7aed6591d9826c276
SHA512

12c2343d8a7385fb1ea9e7b46ee47216cc53445ab40b9708450adb044dcdbf470b9140620de071206a95446ef801fe7cb7164f8a822cd6f4c22a7777b50a2595
SSDEEP

3072:+PUPz54mYWpWUGgYWancdOoDbj78duHvbCQpLtfCczU+vA6VtfROjVmd+zr3/1Q2:AuGmDGPQHDbZvuQtNzU+v3ML

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

472 cmd.exe

pid	process
472	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ianvmjrr.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ianvmjrr.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

description	pid	process	target process
PID 2040 set thread context of 1980	2040	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exeExplorer.EXE

pid	process
2040	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
1980	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
1980	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
1280	Explorer.EXE
1280	Explorer.EXE
1280	Explorer.EXE
1280	Explorer.EXE
1280	Explorer.EXE
1280	Explorer.EXE
1280	Explorer.EXE
1280	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1280 Explorer.EXE

pid	process
1280	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1980	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
Token: SeDebugPrivilege	1280	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1280 Explorer.EXE
1280 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1280 Explorer.EXE
1280 Explorer.EXE

pid	process
1280	Explorer.EXE
1280	Explorer.EXE

pid	process
1280	Explorer.EXE
1280	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

pid	process
2040	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
2040	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1280 Explorer.EXE

pid	process
1280	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exeExplorer.EXE

description	pid	process	target process
PID 2040 wrote to memory of 1980	2040	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 2040 wrote to memory of 1980	2040	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 2040 wrote to memory of 1980	2040	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 2040 wrote to memory of 1980	2040	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 2040 wrote to memory of 1980	2040	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 2040 wrote to memory of 1980	2040	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 2040 wrote to memory of 1980	2040	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 2040 wrote to memory of 1980	2040	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 2040 wrote to memory of 1980	2040	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 2040 wrote to memory of 1980	2040	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
PID 1980 wrote to memory of 472	1980	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	cmd.exe
PID 1980 wrote to memory of 472	1980	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	cmd.exe
PID 1980 wrote to memory of 472	1980	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	cmd.exe
PID 1980 wrote to memory of 472	1980	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	cmd.exe
PID 1980 wrote to memory of 1280	1980	2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe	Explorer.EXE
PID 1280 wrote to memory of 1124	1280	Explorer.EXE	taskhost.exe
PID 1280 wrote to memory of 1204	1280	Explorer.EXE	Dwm.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1124

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1204

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
  "C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
    C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ms284298.bat"
      4⤵
      Deletes itself
      PID:472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms284298.bat

Filesize
201B

MD5
763598dae3c37acfb6a6d97a05cd88ad

SHA1
28f44b6258696c87b77c9e36d55f234d6f23b397

SHA256
a18c505e7ded549c395d5ba64d5e9f9856fa4ad6c0e0f8302c0e72886cb73682

SHA512
8fdadfc37e66a0af0490d43aff4b1e7253b4e758b77e5eb6dc5f56a93b7ffd1f23a96b982cd45b8135874244f47d8da6fa32ada36ee44ca30a6b1feef3618f07

Download Submit
memory/472-71-0x0000000000000000-mapping.dmp

Download
memory/1124-80-0x0000000036D90000-0x0000000036DA0000-memory.dmp

Filesize
64KB

Download
memory/1124-84-0x0000000000320000-0x0000000000337000-memory.dmp

Filesize
92KB

Download
memory/1204-85-0x00000000001A0000-0x00000000001B7000-memory.dmp

Filesize
92KB

Download
memory/1204-82-0x0000000036D90000-0x0000000036DA0000-memory.dmp

Filesize
64KB

Download
memory/1280-72-0x0000000001DA0000-0x0000000001DB7000-memory.dmp

Filesize
92KB

Download
memory/1280-83-0x0000000001DA0000-0x0000000001DB7000-memory.dmp

Filesize
92KB

Download
memory/1280-75-0x0000000036D90000-0x0000000036DA0000-memory.dmp

Filesize
64KB

Download
memory/1980-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1980-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1980-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1980-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1980-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1980-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1980-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1980-64-0x00000000004010C0-mapping.dmp

Download
memory/1980-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2040-54-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/2040-65-0x0000000000260000-0x0000000000264000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads