050fa284bcaa76d29915df1babf3de38cb8efb33e7acb7256873b7f56d29f5f6

General

Target

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Size

168KB
MD5

91291b0c1fb27cff77c5a7731807abf0
SHA1

0cdd5dcdf23c65136faf067d55a098f1fb93469f
SHA256

ede3136fd45a022bb470ff9a2752d4b48c641e1fe6ddc4aa5fa3a414b6921b95
SHA512

65632a66c7cb3fdbdf0e89de5298b378597e96e8a1a96f232669dd7a70235b428b45f529f6175555ea67ad987dbdfade0697b3ee440bfebf9a473db3279b490a
SSDEEP

3072:pVmADg66x5y7FuW3jLi2ikZSYbmlpSchjDeL8lOW+9d+zr3/1C:pVA665pW3Z7ZS9h2LjOM

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

description	pid	process	target process
PID 1688 set thread context of 4668	1688	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exerechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

pid	process
1688	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1688	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
4668	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
4668	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

description pid process

Token: SeDebugPrivilege 4668 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

description	pid	process
Token: SeDebugPrivilege	4668	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

pid	process
1688	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1688	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exerechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

description	pid	process	target process
PID 1688 wrote to memory of 4668	1688	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1688 wrote to memory of 4668	1688	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1688 wrote to memory of 4668	1688	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1688 wrote to memory of 4668	1688	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1688 wrote to memory of 4668	1688	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1688 wrote to memory of 4668	1688	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1688 wrote to memory of 4668	1688	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1688 wrote to memory of 4668	1688	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 1688 wrote to memory of 4668	1688	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
PID 4668 wrote to memory of 2876	4668	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 4668 wrote to memory of 2876	4668	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 4668 wrote to memory of 2876	4668	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	cmd.exe
PID 4668 wrote to memory of 2596	4668	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2596

C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
"C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS3925~1.BAT"
4⤵
PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-132-0x0000000000B40000-0x0000000000BFF000-memory.dmp

Filesize
764KB

Download
memory/1688-136-0x0000000000B40000-0x0000000000B4A000-memory.dmp

Filesize
40KB

Download
memory/2596-140-0x00007FF875710000-0x00007FF875720000-memory.dmp

Filesize
64KB

Download
memory/2876-139-0x0000000000000000-mapping.dmp

Download
memory/4668-133-0x0000000000000000-mapping.dmp

Download
memory/4668-134-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4668-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4668-138-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4668-141-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads