eb7502d970269cdee38637b8f3d6a82359106292a87691d2d77bc5a232270361

General

Target

2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
Size

148KB
MD5

69a462f5962e03c6dc1d34b3ec702ef7
SHA1

42a898eb901252f9839b3376e91c80eb508ecf40
SHA256

7cad924cac4762e897aa2d5406cf63083e9d44d86f61cdde86946e0419746a2c
SHA512

252f8baabb0f160c2886b8d781a55ac747fc443029428929e52d42974eb8bbcc362181b8813c45a91d21dde405859943dd59d148d5f4bb04a5e44e02cca9260f
SSDEEP

3072:xQ/LFEPXCmqhQkGmgb6/d33HfI5NxwCshg0e4FeV3q0E:iTePXBaQkG7G5/Izbye4oVq0

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1148 cmd.exe

pid	process
1148	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ianvmjrr.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ianvmjrr.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe

description	pid	process	target process
PID 1756 set thread context of 2028	1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exeExplorer.EXE

pid	process
1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
2028	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
2028	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1188 Explorer.EXE

pid	process
1188	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	2028	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
Token: SeDebugPrivilege	1188	Explorer.EXE
Token: SeShutdownPrivilege	1188	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1188 Explorer.EXE
1188 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1188 Explorer.EXE
1188 Explorer.EXE

pid	process
1188	Explorer.EXE
1188	Explorer.EXE

pid	process
1188	Explorer.EXE
1188	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe

pid	process
1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1188 Explorer.EXE

pid	process
1188	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exeExplorer.EXE

description	pid	process	target process
PID 1756 wrote to memory of 2028	1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
PID 1756 wrote to memory of 2028	1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
PID 1756 wrote to memory of 2028	1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
PID 1756 wrote to memory of 2028	1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
PID 1756 wrote to memory of 2028	1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
PID 1756 wrote to memory of 2028	1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
PID 1756 wrote to memory of 2028	1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
PID 1756 wrote to memory of 2028	1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
PID 1756 wrote to memory of 2028	1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
PID 1756 wrote to memory of 2028	1756	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
PID 2028 wrote to memory of 1148	2028	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	cmd.exe
PID 2028 wrote to memory of 1148	2028	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	cmd.exe
PID 2028 wrote to memory of 1148	2028	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	cmd.exe
PID 2028 wrote to memory of 1148	2028	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	cmd.exe
PID 2028 wrote to memory of 1188	2028	2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe	Explorer.EXE
PID 1188 wrote to memory of 1112	1188	Explorer.EXE	taskhost.exe
PID 1188 wrote to memory of 1156	1188	Explorer.EXE	Dwm.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1112

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1188

C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
"C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756

C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS4245~1.BAT"
4⤵
- Deletes itself
PID:1148

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms4245398.bat

Filesize
201B

MD5
1802eb7603a75f3ddd1c09b212ae9e32

SHA1
521ca6849fb8dc36b14d9a251ff0cf9cffc2c206

SHA256
e3af5f9783ff36af08d2ca3070a374d0e055cdd1941b329980a0e77a27f7c7b1

SHA512
bc444426599c39a56930782a716d9634061dd0e965476d501bb1ebf01ed2bbe16ace9508a17679fd073878542635fba53e125267c15370e9c8356e07a403fca1

Download Submit
memory/1112-81-0x0000000001BD0000-0x0000000001BE7000-memory.dmp

Filesize
92KB

Download
memory/1112-80-0x0000000036F00000-0x0000000036F10000-memory.dmp

Filesize
64KB

Download
memory/1148-71-0x0000000000000000-mapping.dmp

Download
memory/1156-85-0x00000000001A0000-0x00000000001B7000-memory.dmp

Filesize
92KB

Download
memory/1156-84-0x0000000036F00000-0x0000000036F10000-memory.dmp

Filesize
64KB

Download
memory/1188-72-0x0000000002AB0000-0x0000000002AC7000-memory.dmp

Filesize
92KB

Download
memory/1188-83-0x0000000002AB0000-0x0000000002AC7000-memory.dmp

Filesize
92KB

Download
memory/1188-75-0x0000000036F00000-0x0000000036F10000-memory.dmp

Filesize
64KB

Download
memory/1756-65-0x0000000001BE0000-0x0000000001BE4000-memory.dmp

Filesize
16KB

Download
memory/1756-54-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/2028-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2028-64-0x00000000004010C0-mapping.dmp

Download
memory/2028-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2028-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2028-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2028-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2028-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2028-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2028-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads