be4806234855615f9c50e68bf067ce5dda3ae2138b761dc3a9cc5cf51f520562

Analysis

max time kernel
3s
max time network
7s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
Size

168KB
MD5

bbf602cc98f05af58228dfc975622b04
SHA1

70fb72c5217aed3c52349a3a92fda087297203b5
SHA256

64dbe523c9ff1558fedaba3d2fc6476893cb2286703e69bcb30eb3015f5bd82a
SHA512

bc1e3819532e0cbcc7377c5e64cb100ef211a9e6b502f0d36a14ec0b80d2378e28d3263d64071448901a8096e904a7e845124a5d7ecc2c670459f1d6e783cfcd
SSDEEP

3072:lfmAD4c6xEGUAV31hECI115hswWe25ZU6GEAE+YBTVdX7lqEd+zr3/1C:lfYc6EGUYhECI3pTqjhC0fUlM

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

description	pid	process	target process
PID 1616 set thread context of 2448	1616	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

pid	process
1616	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
1616	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

pid	process
1616	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
1616	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeonline_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

description	pid	process	target process
PID 1616 wrote to memory of 2448	1616	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1616 wrote to memory of 2448	1616	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1616 wrote to memory of 2448	1616	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1616 wrote to memory of 2448	1616	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1616 wrote to memory of 2448	1616	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1616 wrote to memory of 2448	1616	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1616 wrote to memory of 2448	1616	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1616 wrote to memory of 2448	1616	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1616 wrote to memory of 2448	1616	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2448 wrote to memory of 4816	2448	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 2448 wrote to memory of 4816	2448	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 2448 wrote to memory of 4816	2448	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
"C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616

C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2448

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS1733~1.BAT"
3⤵
PID:4816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1616-136-0x00000000006F0000-0x00000000006F4000-memory.dmp

Filesize
16KB

Download
memory/2056-139-0x00007FFD94C10000-0x00007FFD94C20000-memory.dmp

Filesize
64KB

Download
memory/2448-132-0x0000000000000000-mapping.dmp

Download
memory/2448-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2448-135-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4816-137-0x0000000000000000-mapping.dmp

Download