e13ed9e615275e8f16ad49319d57dfa01ae9e4a51d8eabd5c1165bb6497d6ccf

General

Target

2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
Size

204KB
MD5

bf08a33a6aa04fd576d4661bfe409d63
SHA1

33bac2b5647c3cf464e5b2cbd7e108aa75877be9
SHA256

796c421ab9d0cb0b7e2de528cc7535c3eccabb31c888a04796593654ec37a0e2
SHA512

4f11e2e9e606c68afaa534f700f54706f1ce23e99c42398a09e4df7a2481a8c6b07f6ffb2d19db5b2dc2fea7e5b6488692af5eeac52e16ae2b13062d8a3c8140
SSDEEP

3072:KbbbeGI6JRubMVHhRJO13oreqjc2K9FZn0f1MsWzdT6V:hGLRdVHheeOFZ0fGL16V

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ydinjphq.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ydinjphq.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe

description	pid	process	target process
PID 4784 set thread context of 4856	4784	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exeExplorer.EXE

pid	process
4784	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
4784	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
4856	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
4856	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
1084	Explorer.EXE
1084	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe

description pid process

Token: SeDebugPrivilege 4856 2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe

description	pid	process
Token: SeDebugPrivilege	4856	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe

pid	process
4784	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
4784	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe

description	pid	process	target process
PID 4784 wrote to memory of 4856	4784	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
PID 4784 wrote to memory of 4856	4784	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
PID 4784 wrote to memory of 4856	4784	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
PID 4784 wrote to memory of 4856	4784	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
PID 4784 wrote to memory of 4856	4784	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
PID 4784 wrote to memory of 4856	4784	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
PID 4784 wrote to memory of 4856	4784	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
PID 4784 wrote to memory of 4856	4784	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
PID 4784 wrote to memory of 4856	4784	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
PID 4856 wrote to memory of 4884	4856	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	cmd.exe
PID 4856 wrote to memory of 4884	4856	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	cmd.exe
PID 4856 wrote to memory of 4884	4856	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	cmd.exe
PID 4856 wrote to memory of 1084	4856	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1084

C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
"C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784

C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS1161~1.BAT"
4⤵
PID:4884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-140-0x00007FFEADD50000-0x00007FFEADD60000-memory.dmp

Filesize
64KB

Download
memory/2780-141-0x00007FFEADD50000-0x00007FFEADD60000-memory.dmp

Filesize
64KB

Download
memory/4784-134-0x0000000000560000-0x0000000000564000-memory.dmp

Filesize
16KB

Download
memory/4856-132-0x0000000000000000-mapping.dmp

Download
memory/4856-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4856-136-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4856-137-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4856-139-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4884-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads