2b65b3346e0d495ca0de63ce257e0a04d948e675add5bb83c425aecbf1afd8a4

General

Target

telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
Size

204KB
MD5

d03d13c97c10669c812514f3beb12ee9
SHA1

089494b0c40f2bce96c0c84b329f87eff128c43c
SHA256

b613ef4484c38b8d6b0847236b31ce8d916125766d28d3275605fe4e2068ca4c
SHA512

638caef0a27496e17c8c41c794f2b7862826d106d68cdca8284aa8ffd72f5908bc06ba1eb47900dcc5fe269a6a8309f3d3b316d526671e4b6c16b3f6e90a7094
SSDEEP

6144:uoVIiObZbJn9QEI01sV3iWw2s7ldCh8+V+e:RVIiibR9zULPs7lohr9

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1208	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\engtvbbi.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\engtvbbi.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 1356	1400	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	28

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1400	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
1356	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
1356	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1264	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1356	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
Token: SeDebugPrivilege	1264	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1400	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
1400	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1264	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1356	1400	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	28
PID 1400 wrote to memory of 1356	1400	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	28
PID 1400 wrote to memory of 1356	1400	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	28
PID 1400 wrote to memory of 1356	1400	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	28
PID 1400 wrote to memory of 1356	1400	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	28
PID 1400 wrote to memory of 1356	1400	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	28
PID 1400 wrote to memory of 1356	1400	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	28
PID 1400 wrote to memory of 1356	1400	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	28
PID 1400 wrote to memory of 1356	1400	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	28
PID 1400 wrote to memory of 1356	1400	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	28
PID 1356 wrote to memory of 1208	1356	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	29
PID 1356 wrote to memory of 1208	1356	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	29
PID 1356 wrote to memory of 1208	1356	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	29
PID 1356 wrote to memory of 1208	1356	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	29
PID 1356 wrote to memory of 1264	1356	telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe	15
PID 1264 wrote to memory of 1120	1264	Explorer.EXE	18
PID 1264 wrote to memory of 1224	1264	Explorer.EXE	16
PID 1264 wrote to memory of 1208	1264	Explorer.EXE	29
PID 1264 wrote to memory of 668	1264	Explorer.EXE	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
  "C:\Users\Admin\AppData\Local\Temp\telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Users\Admin\AppData\Local\Temp\telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
    C:\Users\Admin\AppData\Local\Temp\telekom_deutschland_dezember_2014_de_0001_3029400_92_928_02020_0_7_293489_0038.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ms525478.bat"
      4⤵
      Deletes itself
      PID:1208

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1224

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1120

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-9892147858744976622039488043-1247587200-666053675-964403429-119032093-1280973567"
1⤵
PID:668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms525478.bat

Filesize
201B

MD5
4abe8dda496b308d3849adbe5a85acb9

SHA1
95cce3aa6d394e2e14201d9ada8d10f431d6ee26

SHA256
a8a49aab51f8c81c2ea075a054c7632672a6ac9333824a0395ae38352d7b79b0

SHA512
8057b15bc9d0947e44658ec769be1f09929ecfe01f4f2dd4087719906fbe10dee8eee33cc40f746b37cd72b63abdad91ecb644255d6b9840a0b45f9c81ce0e64

Download Submit
memory/1120-88-0x0000000001DF0000-0x0000000001E07000-memory.dmp

Filesize
92KB

Download
memory/1120-82-0x0000000037240000-0x0000000037250000-memory.dmp

Filesize
64KB

Download
memory/1208-81-0x0000000000180000-0x0000000000194000-memory.dmp

Filesize
80KB

Download
memory/1224-90-0x00000000002A0000-0x00000000002B7000-memory.dmp

Filesize
92KB

Download
memory/1224-84-0x0000000037240000-0x0000000037250000-memory.dmp

Filesize
64KB

Download
memory/1264-89-0x0000000002A00000-0x0000000002A17000-memory.dmp

Filesize
92KB

Download
memory/1264-76-0x0000000037240000-0x0000000037250000-memory.dmp

Filesize
64KB

Download
memory/1264-74-0x0000000002A00000-0x0000000002A17000-memory.dmp

Filesize
92KB

Download
memory/1356-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1356-72-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1356-69-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1356-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1356-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1356-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1356-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1356-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1356-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1400-65-0x0000000000300000-0x0000000000304000-memory.dmp

Filesize
16KB

Download
memory/1400-54-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing