35b6746d1aacaf96889be39a5ed765e1e6cceb5ac8f38b31ebea625653cf79a1

General

Target

2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe
Size

148KB
MD5

6d114c7a21aab94456d8e8d4aef88362
SHA1

1229f292c46ffa1bde2db69227c4e98c2e46ae3a
SHA256

0b577f76b08c5267eb5f2f8596127a28a6eaf5ff2089cff6be0b689f31850124
SHA512

828b656d5eeb4e225af9bc76fad68fd51f5bc6a867450f200e005782231cfd762ceef3d2341aa9e2dcfca9db656637dda71ee6b93083664a36e15f02a0342e03
SSDEEP

3072:5fSj3q4+o/mYSpVygq2xW+rQDuZz4AYOr8Hkv:xSusZSXRY+rBF4AYOr8

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1700	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1444 set thread context of 1932	1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	27

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe
1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe
1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe
1932	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe
1932	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe
1344	Explorer.EXE
1344	Explorer.EXE
1344	Explorer.EXE
1344	Explorer.EXE
1344	Explorer.EXE
1344	Explorer.EXE
1344	Explorer.EXE
1344	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1344	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe
Token: SeDebugPrivilege	1344	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1344	Explorer.EXE
1344	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1344	Explorer.EXE
1344	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe
1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1344	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1932	1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	27
PID 1444 wrote to memory of 1932	1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	27
PID 1444 wrote to memory of 1932	1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	27
PID 1444 wrote to memory of 1932	1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	27
PID 1444 wrote to memory of 1932	1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	27
PID 1444 wrote to memory of 1932	1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	27
PID 1444 wrote to memory of 1932	1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	27
PID 1444 wrote to memory of 1932	1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	27
PID 1444 wrote to memory of 1932	1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	27
PID 1444 wrote to memory of 1932	1444	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	27
PID 1932 wrote to memory of 1700	1932	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	28
PID 1932 wrote to memory of 1700	1932	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	28
PID 1932 wrote to memory of 1700	1932	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	28
PID 1932 wrote to memory of 1700	1932	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	28
PID 1932 wrote to memory of 1344	1932	2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe	10
PID 1344 wrote to memory of 1200	1344	Explorer.EXE	17
PID 1344 wrote to memory of 1304	1344	Explorer.EXE	16

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Local\Temp\2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe
  "C:\Users\Admin\AppData\Local\Temp\2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Users\Admin\AppData\Local\Temp\2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe
    C:\Users\Admin\AppData\Local\Temp\2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6980~1.BAT"
      4⤵
      Deletes itself
      PID:1700

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1304

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms6980848.bat

Filesize
201B

MD5
a50e86cf6ff44dc4bf3a45b5218faff0

SHA1
d2d7e9888fac1889d23a151759fd41de0aa1b89f

SHA256
d7b6143042a88e1105eee1c390de3491a21a19dfc21e1802fcba8a79d5185b05

SHA512
710443c7ef7a3183a86dc8e2a670e55c1b1f6c484b2bd2ed089a543e841304bdeac9d014ea881fd1087b74d84ae3bd927dd0791267f1f873b37d8f90b1c86d57

Download Submit
memory/1200-84-0x0000000000210000-0x0000000000227000-memory.dmp

Filesize
92KB

Download
memory/1200-81-0x0000000037500000-0x0000000037510000-memory.dmp

Filesize
64KB

Download
memory/1304-85-0x00000000001A0000-0x00000000001B7000-memory.dmp

Filesize
92KB

Download
memory/1304-82-0x0000000037500000-0x0000000037510000-memory.dmp

Filesize
64KB

Download
memory/1344-83-0x0000000001C60000-0x0000000001C77000-memory.dmp

Filesize
92KB

Download
memory/1344-76-0x0000000037500000-0x0000000037510000-memory.dmp

Filesize
64KB

Download
memory/1344-72-0x0000000001C60000-0x0000000001C77000-memory.dmp

Filesize
92KB

Download
memory/1444-54-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1444-66-0x0000000000340000-0x0000000000344000-memory.dmp

Filesize
16KB

Download
memory/1932-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1932-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1932-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1932-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1932-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1932-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1932-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1932-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing