73ff6fa7a5bc69153ae1de460de3cd058bfa5f6f7f00c03cc92919b73fc7eea0

Analysis

max time kernel
214s
max time network
261s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
Size

180KB
MD5

09bc094dd001bbab612c0dd798faaa2c
SHA1

f012e062c8b4c32744984408d7ba0dd9b6e5a768
SHA256

785e58e6aaade2891f3a76577874efb0fbec918602176483a802975efaed3432
SHA512

5ada6bb7d92fc06f3aca3b73b66b9952df174ae59aa7234dfe2040989618d5c8a4edc0ad8eb9e909852201686cfc861f9fdf82cc8b39629dffcbf8ab12a5d168
SSDEEP

3072:2+oHzmI+A8lJRpZY2L0V2IxyME6YMTnin2msljOWRRTYzdTDfhze:2hH7f8Jb09xy56YMu2miTRRTKdPQ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe

description	pid	process	target process
PID 2612 set thread context of 4264	2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe

pid	process
2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe

pid	process
2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe

description	pid	process	target process
PID 2612 wrote to memory of 4264	2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 2612 wrote to memory of 4264	2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 2612 wrote to memory of 4264	2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 2612 wrote to memory of 4264	2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 2612 wrote to memory of 4264	2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 2612 wrote to memory of 4264	2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 2612 wrote to memory of 4264	2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 2612 wrote to memory of 4264	2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
PID 2612 wrote to memory of 4264	2612	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe	2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe

C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
"C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612

C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_K4768955881_pdf_sign_telekom_de_deutschland_gmbh.exe
2⤵
PID:4264

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6921~1.BAT"
3⤵
PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-137-0x0000000000000000-mapping.dmp

Download
memory/2612-134-0x00000000007A0000-0x00000000007A4000-memory.dmp

Filesize
16KB

Download
memory/4264-133-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4264-132-0x0000000000000000-mapping.dmp

Download
memory/4264-136-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download