Analysis
-
max time kernel
250s -
max time network
349s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 05:21
Static task
static1
Behavioral task
behavioral1
Sample
volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe
Resource
win10v2004-20221111-en
General
-
Target
volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe
-
Size
171KB
-
MD5
a804f34778af2e79285fc1322f1b412e
-
SHA1
072450802be854e19fdf8e84b153e64acf37e61d
-
SHA256
787a3ec22002c515ea6093e691c4578d3872cd0e24db671122d65b19e491036b
-
SHA512
306748ac10dcc89af61d4b52f753ba44f4741a2b7b597de8bbce867cd1055640288b8e9f7cd77ebbb2f80c3bacdf3b01097c7eeb95f19285dc807e5fbc46aa9e
-
SSDEEP
3072:igpd+HKWTnOwsDBY4XAHNycjNtTUhx0faUU8EoyDElkCd:igpMHKWTDun+DU6rqYlv
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 544 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\engtvbbi.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\engtvbbi.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exedescription pid process target process PID 564 set thread context of 1940 564 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exevolksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exeExplorer.EXEpid process 564 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe 564 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe 1940 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe 1940 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1940 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe Token: SeDebugPrivilege 1280 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exevolksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exeExplorer.EXEdescription pid process target process PID 564 wrote to memory of 1940 564 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe PID 564 wrote to memory of 1940 564 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe PID 564 wrote to memory of 1940 564 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe PID 564 wrote to memory of 1940 564 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe PID 564 wrote to memory of 1940 564 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe PID 564 wrote to memory of 1940 564 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe PID 564 wrote to memory of 1940 564 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe PID 564 wrote to memory of 1940 564 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe PID 564 wrote to memory of 1940 564 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe PID 564 wrote to memory of 1940 564 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe PID 1940 wrote to memory of 544 1940 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe cmd.exe PID 1940 wrote to memory of 544 1940 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe cmd.exe PID 1940 wrote to memory of 544 1940 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe cmd.exe PID 1940 wrote to memory of 544 1940 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe cmd.exe PID 1940 wrote to memory of 1280 1940 volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe Explorer.EXE PID 1280 wrote to memory of 1132 1280 Explorer.EXE taskhost.exe PID 1280 wrote to memory of 1188 1280 Explorer.EXE Dwm.exe PID 1280 wrote to memory of 564 1280 Explorer.EXE volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe PID 1280 wrote to memory of 544 1280 Explorer.EXE cmd.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe"C:\Users\Admin\AppData\Local\Temp\volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe"C:\Users\Admin\AppData\Local\Temp\volksbank_de_transaktions_id_000023928001_2014_11_0000390382755_00003997550002.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS9502~1.BAT"4⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms9502267.batFilesize
201B
MD54ec09291a3f7f4e8fcce25256eb718fc
SHA11b28a9ecde581235db8ab326d0f4e18f67854a6b
SHA256d242b889c10749d948aae92e17ea43d3dfdc32588deecdb2b48f5b3717e84307
SHA51299b2efb984be238d6a58d3c8db61e57adbd591a9358339bdb7ee2269bb164ebb3ad254e74b0f77068bb64fb6fc0f4dafc5132b3d794e26d8e733b5396152eda5
-
memory/544-86-0x0000000000130000-0x0000000000144000-memory.dmpFilesize
80KB
-
memory/544-72-0x0000000000000000-mapping.dmp
-
memory/564-54-0x0000000076D71000-0x0000000076D73000-memory.dmpFilesize
8KB
-
memory/564-68-0x0000000000240000-0x000000000024E000-memory.dmpFilesize
56KB
-
memory/1132-88-0x0000000001D30000-0x0000000001D47000-memory.dmpFilesize
92KB
-
memory/1132-81-0x0000000037C20000-0x0000000037C30000-memory.dmpFilesize
64KB
-
memory/1188-89-0x0000000001BB0000-0x0000000001BC7000-memory.dmpFilesize
92KB
-
memory/1188-85-0x0000000037C20000-0x0000000037C30000-memory.dmpFilesize
64KB
-
memory/1280-73-0x00000000026E0000-0x00000000026F7000-memory.dmpFilesize
92KB
-
memory/1280-87-0x00000000026E0000-0x00000000026F7000-memory.dmpFilesize
92KB
-
memory/1280-76-0x0000000037C20000-0x0000000037C30000-memory.dmpFilesize
64KB
-
memory/1940-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1940-75-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1940-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1940-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1940-64-0x00000000004010C0-mapping.dmp
-
memory/1940-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1940-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1940-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1940-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1940-55-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB