531a10933b40b0afc170ac5317b7a8997135b4fc692b030588633cc8f08d7668

General

Target

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
Size

168KB
MD5

96a7cae09e4fe1046e056e6e21013b2e
SHA1

082ab3ae77fd10fb6f0f00764fb6dd47fc126f0e
SHA256

5c3b6bb6440d47a0ae66c72c298a56dab4b3f4dcda117e8df649f6915def0131
SHA512

c1632233d901c03da1ed45b7c24856e291f79d7162ae37ec4633346b4dbc0e57b74484ea8f289a3427a2637d74f3dda84bf5e3484611d358df033a674fde1f03
SSDEEP

3072:nVmADgh6x5y7FuW3jLi2ikZSYbmlpSchjDeL8lOW+9d+zr3/1C:nVAh65pW3Z7ZS9h2LjOM

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1136 cmd.exe

pid	process
1136	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ypbkryye.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ypbkryye.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

description	pid	process	target process
PID 1896 set thread context of 1760	1896	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeonline_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeExplorer.EXE

pid	process
1896	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
1760	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
1760	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1760	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
Token: SeDebugPrivilege	1244	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE
1244 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE
1244 Explorer.EXE

pid	process
1244	Explorer.EXE
1244	Explorer.EXE

pid	process
1244	Explorer.EXE
1244	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

pid	process
1896	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
1896	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE

pid	process
1244	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeonline_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeExplorer.EXE

description	pid	process	target process
PID 1896 wrote to memory of 1760	1896	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1896 wrote to memory of 1760	1896	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1896 wrote to memory of 1760	1896	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1896 wrote to memory of 1760	1896	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1896 wrote to memory of 1760	1896	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1896 wrote to memory of 1760	1896	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1896 wrote to memory of 1760	1896	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1896 wrote to memory of 1760	1896	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1896 wrote to memory of 1760	1896	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1896 wrote to memory of 1760	1896	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1760 wrote to memory of 1136	1760	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 1760 wrote to memory of 1136	1760	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 1760 wrote to memory of 1136	1760	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 1760 wrote to memory of 1136	1760	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 1760 wrote to memory of 1244	1760	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	Explorer.EXE
PID 1244 wrote to memory of 1128	1244	Explorer.EXE	taskhost.exe
PID 1244 wrote to memory of 1188	1244	Explorer.EXE	Dwm.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1244

C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
"C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896

C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS5655~1.BAT"
4⤵
- Deletes itself
PID:1136

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1188

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms5655697.bat

Filesize
201B

MD5
4f3ad517b78cb9620a8a6655ca405279

SHA1
e0d83481e73ecab1bb6d3ef21e7f038f6e464689

SHA256
d80bd920f8ec3466f493771122bfa0401a464c375c4d5926095c883be3ed21d5

SHA512
664e8e22d5447893d21f9285b2e0afaf01e04b7818944d7b1fbad9323a510b635e99da0731be19a1f1e19a86e593117e2aabf1449391f6537075fe76b06e5ce8

Download Submit
memory/1128-84-0x0000000000300000-0x0000000000317000-memory.dmp

Filesize
92KB

Download
memory/1128-81-0x0000000037C40000-0x0000000037C50000-memory.dmp

Filesize
64KB

Download
memory/1136-71-0x0000000000000000-mapping.dmp

Download
memory/1188-85-0x0000000001AD0000-0x0000000001AE7000-memory.dmp

Filesize
92KB

Download
memory/1188-82-0x0000000037C40000-0x0000000037C50000-memory.dmp

Filesize
64KB

Download
memory/1244-72-0x00000000029E0000-0x00000000029F7000-memory.dmp

Filesize
92KB

Download
memory/1244-86-0x00000000029E0000-0x00000000029F7000-memory.dmp

Filesize
92KB

Download
memory/1244-83-0x00000000029E0000-0x00000000029F7000-memory.dmp

Filesize
92KB

Download
memory/1244-76-0x0000000037C40000-0x0000000037C50000-memory.dmp

Filesize
64KB

Download
memory/1760-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1760-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1760-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1760-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1760-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1760-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1760-64-0x00000000004010C0-mapping.dmp

Download
memory/1760-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1760-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1896-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1896-65-0x0000000000240000-0x0000000000244000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads