de4a2710d790bdc0a3d8ce259a70d04b5c91bccfa092786adf57a76cb7bd601a

General

Target

rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Size

152KB
MD5

f3ebd9dc2bb17ade3db704bcf06ddb6c
SHA1

8c827a862c86991d6f2012174c982c8bd4673fd1
SHA256

fd72f9b70df6b6acfaa5a6553bd0094a260982aa9a63f38163e380fa600b54c4
SHA512

f627a94307d0ee7517adb49f6820fef9c1a24b81b3777e6d0552ae475080c1b45f4e46ceafe097e9a6eeda48e00491bd7643961fedd8263453e77fb3372075b1
SSDEEP

3072:wXUSu53x+vhiBIVHIpSot5A9mW+iDbG8jOz102+SvJex9Jf+ySd+zr3/182:GChx+5iaVopH7A9mhEG8Sz6LOUj/

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1076 set thread context of 1836	1076	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1076	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1836	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1836	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1076	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
1076	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1836	1076	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1076 wrote to memory of 1836	1076	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1076 wrote to memory of 1836	1076	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1076 wrote to memory of 1836	1076	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1076 wrote to memory of 1836	1076	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1076 wrote to memory of 1836	1076	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1076 wrote to memory of 1836	1076	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1076 wrote to memory of 1836	1076	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1076 wrote to memory of 1836	1076	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1076 wrote to memory of 1836	1076	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	28
PID 1836 wrote to memory of 1792	1836	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	29
PID 1836 wrote to memory of 1792	1836	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	29
PID 1836 wrote to memory of 1792	1836	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	29
PID 1836 wrote to memory of 1792	1836	rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe	29

C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
"C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
  C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6747~1.BAT"
    3⤵
    PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms6747145.bat

Filesize
201B

MD5
0e3892b3aa44d24039256f16103eaa8b

SHA1
61bb27f38c1ae49e0e1a78c7b856df5592fe9e46

SHA256
216d78d89a65b873ec76bbe1087a818895cb809b0c94aabdcab6d9eab6582615

SHA512
8053da14a7787074266960637477cc07d3f4b1b62f5f6e3dae0637827f87a865f5cd3c9c6fa0a07a3d27240c166f2aa36b9c1955b210440ed94d5af5ed1adf19

Download Submit
memory/1076-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1076-65-0x0000000000380000-0x0000000000384000-memory.dmp

Filesize
16KB

Download
memory/1260-72-0x0000000002A50000-0x0000000002A67000-memory.dmp

Filesize
92KB

Download
memory/1836-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1836-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1836-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1836-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1836-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1836-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1836-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1836-75-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing