80b4082c3ea7ac9793143fd390fee292084db68bd2767332561506ba92f90694

Analysis

max time kernel
3s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
Size

196KB
MD5

7c401bde8cafc5b745b9f65effbd588f
SHA1

b5691ee02fb8560e6143785087ce465e0c88cf08
SHA256

47b2a9c7db77b6cd600ffaa2f4691cd772c1a703477b9906942ceda5fb2edb0d
SHA512

10cf7eaf9da0692f91ae8f8a42a970c9083605440c733ff8220f5f9d3783c74e0c94713e83a9b0341289a30d23ba843a18a828601e4d2699ad8b1fe0ea1be3a1
SSDEEP

3072:tj6nX6bQwg4p5d5LSJ0NpCkvYIwrcixkqelXjChTW3JbbeGI6Ja:90qcw6wKIgcixClzChKoGLa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe

description	pid	process	target process
PID 1240 set thread context of 2340	1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe

pid	process
1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe

pid	process
1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exerechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe

description	pid	process	target process
PID 1240 wrote to memory of 2340	1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
PID 1240 wrote to memory of 2340	1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
PID 1240 wrote to memory of 2340	1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
PID 1240 wrote to memory of 2340	1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
PID 1240 wrote to memory of 2340	1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
PID 1240 wrote to memory of 2340	1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
PID 1240 wrote to memory of 2340	1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
PID 1240 wrote to memory of 2340	1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
PID 1240 wrote to memory of 2340	1240	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
PID 2340 wrote to memory of 1400	2340	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe	cmd.exe
PID 2340 wrote to memory of 1400	2340	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe	cmd.exe
PID 2340 wrote to memory of 1400	2340	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
"C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240

C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
C:\Users\Admin\AppData\Local\Temp\rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS4380~1.BAT"
3⤵
PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/760-138-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp

Filesize
64KB

Download
memory/1240-134-0x0000000000710000-0x0000000000714000-memory.dmp

Filesize
16KB

Download
memory/1400-137-0x0000000000000000-mapping.dmp

Download
memory/2340-132-0x0000000000000000-mapping.dmp

Download
memory/2340-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2340-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download