902936547cb2b3c6437e574ef7e4a56b5564553e6a4284a3a395c5c5af36e0a6

General

Target

2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
Size

176KB
MD5

0bdbb242c3d65c99b0c4b3bdad19a793
SHA1

1b2a37b64b1a7ca71b801125faca273408bb7e67
SHA256

942b643d07c0cb4ac1593dccd846fe4bcda402f5f74fa4ba1437248e7c89e0c3
SHA512

387c6455dc286989d0de8b418505b5453ce82c262132eba2975006b59057a698bb5fe33bfa428690d0db30b3396ba6b699a1ad2b68482bc04df27975ca19206e
SSDEEP

3072:bBfHcmI+fMEJRvGGs4Edlb9kMv0UNLp+CSYnzyZyvBwwQlF9KwrrznF19AaROhze:blH80NJ5ZEdT8UlpaYzyZeBzQJPrrjFt

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
616	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ianvmjrr.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ianvmjrr.exe\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 1344	1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	28

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
1344	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
1344	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1284	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1344	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
Token: SeDebugPrivilege	1284	Explorer.EXE
Token: SeShutdownPrivilege	1284	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1284	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1344	1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	28
PID 1276 wrote to memory of 1344	1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	28
PID 1276 wrote to memory of 1344	1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	28
PID 1276 wrote to memory of 1344	1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	28
PID 1276 wrote to memory of 1344	1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	28
PID 1276 wrote to memory of 1344	1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	28
PID 1276 wrote to memory of 1344	1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	28
PID 1276 wrote to memory of 1344	1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	28
PID 1276 wrote to memory of 1344	1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	28
PID 1276 wrote to memory of 1344	1276	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	28
PID 1344 wrote to memory of 616	1344	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	29
PID 1344 wrote to memory of 616	1344	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	29
PID 1344 wrote to memory of 616	1344	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	29
PID 1344 wrote to memory of 616	1344	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	29
PID 1344 wrote to memory of 1284	1344	2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe	15
PID 1284 wrote to memory of 1128	1284	Explorer.EXE	7
PID 1284 wrote to memory of 1128	1284	Explorer.EXE	7
PID 1284 wrote to memory of 1228	1284	Explorer.EXE	16
PID 1284 wrote to memory of 1228	1284	Explorer.EXE	16

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1128

C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
"C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
  C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_00002383882_november_002818273_11_0000000392_000005.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS9082~1.BAT"
    3⤵
    - Deletes itself
    PID:616

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms9082233.bat

Filesize
201B

MD5
920a448d32448d086d206c37288cc71b

SHA1
247deaa929e8229a4c543e985b1a9a125688ed14

SHA256
8fcf472fda4e76d771eccd3b515558b76e7513da7e013e95b8214bb4e3fc883f

SHA512
71034a7141d83b5fbca9fc1ed2221a17a1ba99096713bef6fc778991b2fd2a73b8e5f22f4030d0792ae495f34c37fc511821e0d7662750b18ee8f108137aa96a

Download Submit
memory/616-71-0x0000000000000000-mapping.dmp

Download
memory/1128-90-0x0000000001BF0000-0x0000000001C07000-memory.dmp

Filesize
92KB

Download
memory/1128-92-0x00000000003A0000-0x00000000003B7000-memory.dmp

Filesize
92KB

Download
memory/1128-87-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Filesize
64KB

Download
memory/1128-85-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Filesize
64KB

Download
memory/1228-88-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Filesize
64KB

Download
memory/1228-91-0x00000000001C0000-0x00000000001D7000-memory.dmp

Filesize
92KB

Download
memory/1228-93-0x0000000000120000-0x0000000000137000-memory.dmp

Filesize
92KB

Download
memory/1228-86-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Filesize
64KB

Download
memory/1276-66-0x0000000000380000-0x0000000000384000-memory.dmp

Filesize
16KB

Download
memory/1276-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1284-89-0x00000000029A0000-0x00000000029B7000-memory.dmp

Filesize
92KB

Download
memory/1284-72-0x00000000029A0000-0x00000000029B7000-memory.dmp

Filesize
92KB

Download
memory/1284-76-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Filesize
64KB

Download
memory/1344-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1344-75-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1344-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1344-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1344-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1344-64-0x00000000004010C0-mapping.dmp

Download
memory/1344-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1344-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1344-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing