050d029a5e48f462a4378e93c8e3199bc29ec04ff1cca3b44e6427a182dee24a

General

Target

rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
Size

188KB
MD5

e3ace455382fa7708264257983339263
SHA1

ab979cc544c46903d41fe773c568e2fa54a9bc44
SHA256

f2d682b9bd2857603944471a9baf4a8d83a897d7be57dbf473c8f07fd8f5ed1a
SHA512

be4a8e0770d30eb888a27490954b6109353673234f3b30b3c384d624ff79f3171a3ffff310883cb2f0930f0c64edb716171a78b3a166b44d855c08a0742c46ff
SSDEEP

3072:gudusODvGZVHhS1drkr3k1hsz3F8ol/Lg7Qir8B/xjcbfMrRPyczWIqT9tYhOddx:k9+phSzOFUs/F08PLWIqT2M

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1140	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ianvmjrr.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\ianvmjrr.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1356 set thread context of 1364	1356	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1356	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
1364	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
1364	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1272	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1364	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
Token: SeDebugPrivilege	1272	Explorer.EXE
Token: SeShutdownPrivilege	1272	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1356	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
1356	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1272	Explorer.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1364	1356	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 1356 wrote to memory of 1364	1356	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 1356 wrote to memory of 1364	1356	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 1356 wrote to memory of 1364	1356	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 1356 wrote to memory of 1364	1356	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 1356 wrote to memory of 1364	1356	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 1356 wrote to memory of 1364	1356	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 1356 wrote to memory of 1364	1356	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 1356 wrote to memory of 1364	1356	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 1356 wrote to memory of 1364	1356	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	28
PID 1364 wrote to memory of 1140	1364	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	29
PID 1364 wrote to memory of 1140	1364	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	29
PID 1364 wrote to memory of 1140	1364	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	29
PID 1364 wrote to memory of 1140	1364	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	29
PID 1364 wrote to memory of 1272	1364	rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe	19
PID 1272 wrote to memory of 1148	1272	Explorer.EXE	18
PID 1272 wrote to memory of 1148	1272	Explorer.EXE	18
PID 1272 wrote to memory of 1236	1272	Explorer.EXE	20
PID 1272 wrote to memory of 1140	1272	Explorer.EXE	29
PID 1272 wrote to memory of 1140	1272	Explorer.EXE	29
PID 1272 wrote to memory of 432	1272	Explorer.EXE	30

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1148

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
  "C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
    C:\Users\Admin\AppData\Local\Temp\rechnung_vodafone_team_0000399387201_0020398478002_0003_77352_192_0200002.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS7921~1.BAT"
      4⤵
      Deletes itself
      PID:1140

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1236

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1321468786-305325399-1247776549-1709128616-37231726905878190-334584036-1070824153"
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms7921405.bat

Filesize
201B

MD5
ad1952aa4665d56c4a470871ff6ccd94

SHA1
ed158f9adae7230bf2bdf4c0ba39c4253a318a89

SHA256
5880e263922a8c0ead27768e590038f50d4ba7bc48494764278726c8d1f2718f

SHA512
0a384e88359a86ce446784a8d080b56e4698f9db0cee80d663c33c8f8fbd47920296e175f20b043b15129e4ab11ceeabe287e19f92b4a7649f90535a0510f04d

Download Submit
memory/432-92-0x00000000000F0000-0x0000000000107000-memory.dmp

Filesize
92KB

Download
memory/1140-82-0x0000000000080000-0x0000000000094000-memory.dmp

Filesize
80KB

Download
memory/1148-96-0x0000000001CC0000-0x0000000001CD7000-memory.dmp

Filesize
92KB

Download
memory/1148-94-0x0000000001CE0000-0x0000000001CF7000-memory.dmp

Filesize
92KB

Download
memory/1148-91-0x0000000037180000-0x0000000037190000-memory.dmp

Filesize
64KB

Download
memory/1148-88-0x0000000037180000-0x0000000037190000-memory.dmp

Filesize
64KB

Download
memory/1236-95-0x00000000001A0000-0x00000000001B7000-memory.dmp

Filesize
92KB

Download
memory/1236-89-0x0000000037180000-0x0000000037190000-memory.dmp

Filesize
64KB

Download
memory/1272-73-0x00000000029A0000-0x00000000029B7000-memory.dmp

Filesize
92KB

Download
memory/1272-75-0x0000000037180000-0x0000000037190000-memory.dmp

Filesize
64KB

Download
memory/1272-93-0x00000000029A0000-0x00000000029B7000-memory.dmp

Filesize
92KB

Download
memory/1356-65-0x0000000000380000-0x0000000000384000-memory.dmp

Filesize
16KB

Download
memory/1356-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1364-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1364-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1364-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1364-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1364-71-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1364-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1364-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1364-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing