eac9f998e6403476e76269d87bd97dff46942e450d5640b7ac120154fd9187f5

General

Target

2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
Size

160KB
MD5

177b75910ae8c0091bafef4950c0b224
SHA1

d4dfb2d2b40224310fbd6d928bf7eded03d814bd
SHA256

3d5fda867fdfb3f414b8edcdda6cefd89118df4399043c35f8e901dae66f7b1b
SHA512

c315ba1d9255fc93ae42a20549645e4a2f2eddddc89b65422c3b8b78f951cba432eff66ab2fac6c1061cfd0738d0918b7730a0b0af4ccfc322a1f97c30e5dc47
SSDEEP

3072:A7tcYSClxQuNuqBkXhQRFFO98DZsJxV1bhZuHKYUl9DGLeb+crM8:otcclxTRjfDZs/Ph4HKYfBt8

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2040	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtntglna.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\gtntglna.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 980	1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
980	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
980	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	980	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
Token: SeDebugPrivilege	1376	Explorer.EXE
Token: SeShutdownPrivilege	1376	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1376	Explorer.EXE
1376	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1376	Explorer.EXE
1376	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 980	1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 1932 wrote to memory of 980	1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 1932 wrote to memory of 980	1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 1932 wrote to memory of 980	1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 1932 wrote to memory of 980	1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 1932 wrote to memory of 980	1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 1932 wrote to memory of 980	1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 1932 wrote to memory of 980	1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 1932 wrote to memory of 980	1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 1932 wrote to memory of 980	1932	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	28
PID 980 wrote to memory of 2040	980	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	29
PID 980 wrote to memory of 2040	980	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	29
PID 980 wrote to memory of 2040	980	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	29
PID 980 wrote to memory of 2040	980	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	29
PID 980 wrote to memory of 1376	980	2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe	20
PID 1376 wrote to memory of 1216	1376	Explorer.EXE	18
PID 1376 wrote to memory of 1216	1376	Explorer.EXE	18
PID 1376 wrote to memory of 1296	1376	Explorer.EXE	19
PID 1376 wrote to memory of 2040	1376	Explorer.EXE	29
PID 1376 wrote to memory of 2040	1376	Explorer.EXE	29
PID 1376 wrote to memory of 1988	1376	Explorer.EXE	30

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1216

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1296

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
  "C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
    C:\Users\Admin\AppData\Local\Temp\2014_11rechnungonline_pdf_vodafone_0095890374_537999190_82135674.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:980
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ms67357.bat"
      4⤵
      Deletes itself
      PID:2040

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1501962695182194761788215754314713125137567788301581250091257845821-1936345366"
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms67357.bat

Filesize
200B

MD5
b9d9e82c39baada042b580bc07867983

SHA1
284d855bbdd1e35e8e6d870fe0b637b710279538

SHA256
c03b0229471240f32605697b68581a46df6326bcc0bc9c51793a71b26ea7ace7

SHA512
03bb4456170d5883217217d72e665271dcc4c40b8ee262a78605cd631e88d8e276e8227671fa36c838ed60741f99d382e40770142aeba90d08b2d187fd248fba

Download Submit
memory/980-63-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/980-58-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/980-60-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/980-62-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/980-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/980-74-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/980-56-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/980-67-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1216-94-0x00000000002D0000-0x00000000002E7000-memory.dmp

Filesize
92KB

Download
memory/1216-97-0x00000000002B0000-0x00000000002C7000-memory.dmp

Filesize
92KB

Download
memory/1216-87-0x00000000374A0000-0x00000000374B0000-memory.dmp

Filesize
64KB

Download
memory/1216-82-0x00000000374A0000-0x00000000374B0000-memory.dmp

Filesize
64KB

Download
memory/1296-96-0x0000000001BD0000-0x0000000001BE7000-memory.dmp

Filesize
92KB

Download
memory/1296-85-0x00000000374A0000-0x00000000374B0000-memory.dmp

Filesize
64KB

Download
memory/1376-72-0x0000000002720000-0x0000000002737000-memory.dmp

Filesize
92KB

Download
memory/1376-95-0x0000000002720000-0x0000000002737000-memory.dmp

Filesize
92KB

Download
memory/1376-75-0x00000000374A0000-0x00000000374B0000-memory.dmp

Filesize
64KB

Download
memory/1932-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1932-65-0x00000000002B0000-0x00000000002B4000-memory.dmp

Filesize
16KB

Download
memory/1988-93-0x00000000000D0000-0x00000000000E7000-memory.dmp

Filesize
92KB

Download
memory/2040-92-0x0000000000110000-0x0000000000124000-memory.dmp

Filesize
80KB

Download
memory/2040-83-0x00000000000F0000-0x0000000000104000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing