2c8f8726d8b1972f04db49d696a643fd74a913c5e1dce7a825252b08f546987d

General

Target

rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
Size

172KB
MD5

c06b551f110824f92f7dd6e1e286338b
SHA1

b1451aabe43b20ddfe11ba08cda0716a47cf9fe6
SHA256

0fdc5af087744ec47f94d6d98b05c2f018a5b16bb097a7826f096bc6f7ffd92f
SHA512

4ae0cee0c75e61be40d33635b658d3ea0e074b7f4246a037da60ee6075906583b532236e41e1a3910684b9d8b71fecbcdadc1f9249bacf94b7726818cfbdc576
SSDEEP

3072:Lw0CwITzueTD9d0h06Up164tnYx82gGtjdkruyjn:LwYuzue/9+hpK8i4IGtj4

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1312	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\loibgjiv.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\loibgjiv.exe\""	Explorer.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 772 set thread context of 960	772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	28

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
960	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
960	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1220	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
Token: SeDebugPrivilege	1220	Explorer.EXE
Token: SeShutdownPrivilege	1220	Explorer.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1220	Explorer.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 960	772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	28
PID 772 wrote to memory of 960	772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	28
PID 772 wrote to memory of 960	772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	28
PID 772 wrote to memory of 960	772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	28
PID 772 wrote to memory of 960	772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	28
PID 772 wrote to memory of 960	772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	28
PID 772 wrote to memory of 960	772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	28
PID 772 wrote to memory of 960	772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	28
PID 772 wrote to memory of 960	772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	28
PID 772 wrote to memory of 960	772	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	28
PID 960 wrote to memory of 1312	960	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	29
PID 960 wrote to memory of 1312	960	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	29
PID 960 wrote to memory of 1312	960	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	29
PID 960 wrote to memory of 1312	960	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	29
PID 960 wrote to memory of 1220	960	rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe	14
PID 1220 wrote to memory of 1120	1220	Explorer.EXE	15
PID 1220 wrote to memory of 1192	1220	Explorer.EXE	7
PID 1220 wrote to memory of 1192	1220	Explorer.EXE	7
PID 1220 wrote to memory of 1312	1220	Explorer.EXE	29
PID 1220 wrote to memory of 696	1220	Explorer.EXE	30
PID 1220 wrote to memory of 696	1220	Explorer.EXE	30

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1192

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
  "C:\Users\Admin\AppData\Local\Temp\rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Users\Admin\AppData\Local\Temp\rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
    C:\Users\Admin\AppData\Local\Temp\rechnungonline_telekom_000002920019_2014_11_43726700032_de_003938289_027.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS3818~1.BAT"
      4⤵
      Deletes itself
      PID:1312

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1120

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "80325830413852355861663589933-789737212-6811871191217078835-1042427586-1477503622"
1⤵
PID:696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ms3818398.bat

Filesize
201B

MD5
6f009d6cc68b6ba0541c57862bdfecb9

SHA1
85cdd96c5123aeb9a23db1c62dffb4d921962516

SHA256
2482a2c19ba0e50b5e1b6813146c99da257826463bf9f8f14e057f6aa4620785

SHA512
1939c23a48db5cc6b2bbd60c35fca4bde0bf6b76aad9d1ff2fdf017a72a6d6c8c4c8a81400070092afb8403ac6ceedc852168e8918a5a2fffe367a28a86d335e

Download Submit
memory/696-94-0x00000000001B0000-0x00000000001C7000-memory.dmp

Filesize
92KB

Download
memory/696-93-0x0000000001B00000-0x0000000001B17000-memory.dmp

Filesize
92KB

Download
memory/696-92-0x0000000036F90000-0x0000000036FA0000-memory.dmp

Filesize
64KB

Download
memory/772-65-0x0000000000EC0000-0x0000000000EC4000-memory.dmp

Filesize
16KB

Download
memory/772-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/960-74-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/960-67-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/960-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/960-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/960-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/960-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/960-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/960-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1120-90-0x0000000036F90000-0x0000000036FA0000-memory.dmp

Filesize
64KB

Download
memory/1120-97-0x0000000001C40000-0x0000000001C57000-memory.dmp

Filesize
92KB

Download
memory/1192-89-0x0000000036F90000-0x0000000036FA0000-memory.dmp

Filesize
64KB

Download
memory/1192-91-0x0000000036F90000-0x0000000036FA0000-memory.dmp

Filesize
64KB

Download
memory/1192-95-0x00000000001C0000-0x00000000001D7000-memory.dmp

Filesize
92KB

Download
memory/1192-98-0x00000000001A0000-0x00000000001B7000-memory.dmp

Filesize
92KB

Download
memory/1220-75-0x0000000036F90000-0x0000000036FA0000-memory.dmp

Filesize
64KB

Download
memory/1220-72-0x00000000029C0000-0x00000000029D7000-memory.dmp

Filesize
92KB

Download
memory/1220-96-0x00000000029C0000-0x00000000029D7000-memory.dmp

Filesize
92KB

Download
memory/1312-82-0x0000000000130000-0x0000000000144000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing