feba4b120af767dd134ed1dfcadacd5b36f2332440df2611aa586b9b3c0a84f3

General

Target

online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
Size

168KB
MD5

03bbe5696e292a27becc2197f1024a16
SHA1

59802f9b918bed69eaf113f1ab24698bd46392d0
SHA256

6452bb100340136bacfe46a6c14d211f409144fe0919768fde8feb52536583a5
SHA512

36b8b3f166e87aa9c34401159dc16d0f757d1750a66bfe580e754677c59666c000a8c92484dec025ab8ec379096e24271435f25fb9e507a36d31bfc70f1bd270
SSDEEP

3072:2dLyZlwEyKcoO29Y5eCPN2bViTphJP12EFs+NLVgu2TVAOWX:oLaw7F3CY5e+CVi/yEXlVh2hk

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
468	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\engtvbbi.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\engtvbbi.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2044 set thread context of 920	2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	28

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
920	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
920	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1272	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	920	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
Token: SeDebugPrivilege	1272	Explorer.EXE
Token: SeShutdownPrivilege	1272	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1272	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 920	2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	28
PID 2044 wrote to memory of 920	2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	28
PID 2044 wrote to memory of 920	2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	28
PID 2044 wrote to memory of 920	2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	28
PID 2044 wrote to memory of 920	2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	28
PID 2044 wrote to memory of 920	2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	28
PID 2044 wrote to memory of 920	2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	28
PID 2044 wrote to memory of 920	2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	28
PID 2044 wrote to memory of 920	2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	28
PID 2044 wrote to memory of 920	2044	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	28
PID 920 wrote to memory of 468	920	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	29
PID 920 wrote to memory of 468	920	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	29
PID 920 wrote to memory of 468	920	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	29
PID 920 wrote to memory of 468	920	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	29
PID 920 wrote to memory of 1272	920	online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe	14
PID 1272 wrote to memory of 1156	1272	Explorer.EXE	7
PID 1272 wrote to memory of 1156	1272	Explorer.EXE	7
PID 1272 wrote to memory of 1236	1272	Explorer.EXE	15

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1156

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
  "C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
    C:\Users\Admin\AppData\Local\Temp\online_transaktions_11_2014_0939380001_12987384_93_39_003_365_9388347_00111_02000028.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS3024~1.BAT"
      4⤵
      Deletes itself
      PID:468

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms3024091.bat

Filesize
201B

MD5
8780420fece291e7acd9bce3e959c79c

SHA1
42bcd99e12fd118e6a46bc93ac3df2a6631be57f

SHA256
155307b0ab84d059ceed0509481f8a396eaeb0ad8c21f9e9aef9a05443966810

SHA512
fc39bb7384db665c7acf861fa517c79ea30389bdb2cfff23d652ddcf66df976aae9a28868ef7a15afd664e30148ac655a4f3f4e19547eb8b7ed9cd3e538fd107

Download Submit
memory/920-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/920-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/920-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/920-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/920-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/920-75-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/920-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/920-70-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/920-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1156-84-0x0000000036FB0000-0x0000000036FC0000-memory.dmp

Filesize
64KB

Download
memory/1156-89-0x0000000001BD0000-0x0000000001BE7000-memory.dmp

Filesize
92KB

Download
memory/1156-85-0x0000000036FB0000-0x0000000036FC0000-memory.dmp

Filesize
64KB

Download
memory/1156-88-0x0000000001E90000-0x0000000001EA7000-memory.dmp

Filesize
92KB

Download
memory/1236-86-0x0000000036FB0000-0x0000000036FC0000-memory.dmp

Filesize
64KB

Download
memory/1236-90-0x0000000000120000-0x0000000000137000-memory.dmp

Filesize
92KB

Download
memory/1272-76-0x0000000036FB0000-0x0000000036FC0000-memory.dmp

Filesize
64KB

Download
memory/1272-73-0x0000000002A50000-0x0000000002A67000-memory.dmp

Filesize
92KB

Download
memory/1272-87-0x0000000002A50000-0x0000000002A67000-memory.dmp

Filesize
92KB

Download
memory/2044-65-0x00000000003F0000-0x00000000003F4000-memory.dmp

Filesize
16KB

Download
memory/2044-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing