a3c48fe2567f748e07827c1a86b86bc28a88b231e01897980442bede5bd84c38

General

Target

Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
Size

204KB
MD5

60e35d1acbde6b22234c712c97869cfd
SHA1

810a916c1d70376dadedebd9e83454c923346bf0
SHA256

b6c2dcc6ea4160d06b1b9c077c60c20a696633cbed86cbc82f4c24e01205ff90
SHA512

d23fb897260b02c3a097cc52cde48d06a595ceea18afa66c692ab7c13e4eb887229f923902d7d5cdd04d544e7d9474ea88a223411248405c8914b9933950b7a1
SSDEEP

6144:qoVIiObZbJn9QEI01sV3iWw2s7ldCh8+V+e:1VIiibR9zULPs7lohr9

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1036	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ianvmjrr.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ianvmjrr.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1252 set thread context of 820	1252	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	28

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1252	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
820	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
820	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1220	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	820	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
Token: SeDebugPrivilege	1220	Explorer.EXE
Token: SeShutdownPrivilege	1220	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1252	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
1252	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1220	Explorer.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 820	1252	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	28
PID 1252 wrote to memory of 820	1252	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	28
PID 1252 wrote to memory of 820	1252	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	28
PID 1252 wrote to memory of 820	1252	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	28
PID 1252 wrote to memory of 820	1252	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	28
PID 1252 wrote to memory of 820	1252	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	28
PID 1252 wrote to memory of 820	1252	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	28
PID 1252 wrote to memory of 820	1252	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	28
PID 1252 wrote to memory of 820	1252	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	28
PID 1252 wrote to memory of 820	1252	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	28
PID 820 wrote to memory of 1036	820	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	29
PID 820 wrote to memory of 1036	820	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	29
PID 820 wrote to memory of 1036	820	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	29
PID 820 wrote to memory of 1036	820	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	29
PID 820 wrote to memory of 1220	820	Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe	17
PID 1220 wrote to memory of 1116	1220	Explorer.EXE	18
PID 1220 wrote to memory of 1172	1220	Explorer.EXE	16
PID 1220 wrote to memory of 1036	1220	Explorer.EXE	29
PID 1220 wrote to memory of 1036	1220	Explorer.EXE	29
PID 1220 wrote to memory of 1476	1220	Explorer.EXE	30

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
  "C:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
    C:\Users\Admin\AppData\Local\Temp\Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS2476~1.BAT"
      4⤵
      Deletes itself
      PID:1036

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1116

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1485155040-96825141253633638296356627-958849348-668981143445992585-1329175643"
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms2476501.bat

Filesize
201B

MD5
2ee10c6c0ec1d218ea5da118e730b2c4

SHA1
153c60e41bed5d6e57ca07e14195d17a065754ca

SHA256
0023e5545590d30ced8a919a7c600d93eb5d270b82ebd5185e0453e6d27b9dad

SHA512
c21fc3428a71852c079c4e1b04b7d2782397f7ab22821333dbb1db164a25c43bef6b6d8718172c68be11a2e9ca78f5f3e2e3f7c07c62056265f467b2391afc39

Download Submit
memory/820-71-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/820-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/820-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/820-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/820-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/820-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/820-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/820-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1036-80-0x00000000000F0000-0x0000000000104000-memory.dmp

Filesize
80KB

Download
memory/1116-91-0x0000000001B40000-0x0000000001B57000-memory.dmp

Filesize
92KB

Download
memory/1116-87-0x0000000036F80000-0x0000000036F90000-memory.dmp

Filesize
64KB

Download
memory/1172-93-0x00000000001A0000-0x00000000001B7000-memory.dmp

Filesize
92KB

Download
memory/1172-86-0x0000000036F80000-0x0000000036F90000-memory.dmp

Filesize
64KB

Download
memory/1220-73-0x0000000002A80000-0x0000000002A97000-memory.dmp

Filesize
92KB

Download
memory/1220-75-0x0000000036F80000-0x0000000036F90000-memory.dmp

Filesize
64KB

Download
memory/1220-92-0x0000000002A80000-0x0000000002A97000-memory.dmp

Filesize
92KB

Download
memory/1252-54-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download
memory/1252-65-0x0000000000320000-0x0000000000324000-memory.dmp

Filesize
16KB

Download
memory/1476-89-0x0000000036F80000-0x0000000036F90000-memory.dmp

Filesize
64KB

Download
memory/1476-90-0x00000000000B0000-0x00000000000C7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing