4698a796eede593a47ab515ad8456f7945826168d7808a1058582e1af869693a

General

Target

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
Size

188KB
MD5

e3ace455382fa7708264257983339263
SHA1

ab979cc544c46903d41fe773c568e2fa54a9bc44
SHA256

f2d682b9bd2857603944471a9baf4a8d83a897d7be57dbf473c8f07fd8f5ed1a
SHA512

be4a8e0770d30eb888a27490954b6109353673234f3b30b3c384d624ff79f3171a3ffff310883cb2f0930f0c64edb716171a78b3a166b44d855c08a0742c46ff
SSDEEP

3072:gudusODvGZVHhS1drkr3k1hsz3F8ol/Lg7Qir8B/xjcbfMrRPyczWIqT9tYhOddx:k9+phSzOFUs/F08PLWIqT2M

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

904 cmd.exe

pid	process
904	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\loibgjiv.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\loibgjiv.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

description	pid	process	target process
PID 2012 set thread context of 1996	2012	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeonline_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeExplorer.EXE

pid	process
2012	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
1996	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
1996	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1212 Explorer.EXE

pid	process
1212	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1996	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
Token: SeDebugPrivilege	1212	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1212 Explorer.EXE
1212 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1212 Explorer.EXE
1212 Explorer.EXE

pid	process
1212	Explorer.EXE
1212	Explorer.EXE

pid	process
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

pid	process
2012	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
2012	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1212 Explorer.EXE

pid	process
1212	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeonline_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exeExplorer.EXE

description	pid	process	target process
PID 2012 wrote to memory of 1996	2012	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2012 wrote to memory of 1996	2012	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2012 wrote to memory of 1996	2012	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2012 wrote to memory of 1996	2012	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2012 wrote to memory of 1996	2012	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2012 wrote to memory of 1996	2012	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2012 wrote to memory of 1996	2012	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2012 wrote to memory of 1996	2012	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2012 wrote to memory of 1996	2012	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 2012 wrote to memory of 1996	2012	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
PID 1996 wrote to memory of 904	1996	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 1996 wrote to memory of 904	1996	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 1996 wrote to memory of 904	1996	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 1996 wrote to memory of 904	1996	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	cmd.exe
PID 1996 wrote to memory of 1212	1996	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	Explorer.EXE
PID 1212 wrote to memory of 1124	1212	Explorer.EXE	taskhost.exe
PID 1212 wrote to memory of 1184	1212	Explorer.EXE	Dwm.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1212

C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
"C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012

C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6374~1.BAT"
4⤵
- Deletes itself
PID:904

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1184

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms6374069.bat

Filesize
201B

MD5
9b3928de94541ae563c5f24c18609924

SHA1
1e4a7bef213d1869da286123f78b12251929ca68

SHA256
ebbb5d928ec597dd223798d3e1f9cc528a9c9527f16a28a5f6a7cdf7b8e5d9f9

SHA512
7e04ca8689910d59dc8c05dfb340a7ffdd313643cf71a5918f8ccadd0ce891557ae8f00cfeb09b85cb8578284e84fd17d85a2bd3a7db962103634152d47a801e

Download Submit
memory/904-71-0x0000000000000000-mapping.dmp

Download
memory/1124-80-0x0000000036DB0000-0x0000000036DC0000-memory.dmp

Filesize
64KB

Download
memory/1124-84-0x00000000004A0000-0x00000000004B7000-memory.dmp

Filesize
92KB

Download
memory/1184-85-0x00000000001B0000-0x00000000001C7000-memory.dmp

Filesize
92KB

Download
memory/1184-82-0x0000000036DB0000-0x0000000036DC0000-memory.dmp

Filesize
64KB

Download
memory/1212-72-0x0000000002600000-0x0000000002617000-memory.dmp

Filesize
92KB

Download
memory/1212-83-0x0000000002600000-0x0000000002617000-memory.dmp

Filesize
92KB

Download
memory/1212-75-0x0000000036DB0000-0x0000000036DC0000-memory.dmp

Filesize
64KB

Download
memory/1996-64-0x00000000004010C0-mapping.dmp

Download
memory/1996-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1996-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1996-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1996-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1996-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1996-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1996-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1996-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2012-65-0x0000000000300000-0x0000000000304000-memory.dmp

Filesize
16KB

Download
memory/2012-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads