Overview

overview

7

Static

static

rechnung_1...05.exe

windows7-x64

7

rechnung_1...05.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    130s
  • max time network
    213s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/11/2022, 04:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe

  • Size

    176KB

  • MD5

    5095f22cbdd7c59303fb7d670c97afa5

  • SHA1

    35712036e76c5215b512f9ddb73321617387a98c

  • SHA256

    79e4ffae8c0d0abd80d090d5f3465855b25955509e78d0ced3eab4cfa6d43015

  • SHA512

    9c4815c773a1b57c1178056fec3063894869b51af02cca52baf94a8ee1644d90a2b7444951979f15ecf90f718ad920353cf21927e754158580e479ea5106c0fc

  • SSDEEP

    3072:5KzHNmI+9MEJRuOmz1C+cSQStd3jUQdW6OTHeOO16ogZrssN6wc+ga0Mhze:5qHByNJGBC+Cqz14TE6dZr5PQ

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
      "C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4424
      • C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
        C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4228
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS9400~1.BAT"
          4⤵
            PID:4088
    • C:\Windows\system32\taskhostw.exe
      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
      1⤵
        PID:2660
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
        1⤵
          PID:2456
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2416

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/1056-139-0x00007FF9B3E30000-0x00007FF9B3E40000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/2416-140-0x00007FF9B3E30000-0x00007FF9B3E40000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4228-133-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/4228-136-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/4228-138-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/4424-134-0x0000000002380000-0x0000000002384000-memory.dmp

                  Filesize

                  16KB

                  Download