Overview

overview

7

Static

static

rechnung_v...30.exe

windows7-x64

7

rechnung_v...30.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7edfcf6bc8cdb53461ca26f9e01002405486fc1d3d53dec959825f9c460cd38a

  • Size

    130KB

  • Sample

    221124-e18mzsha48

  • MD5

    cdca19297ff3cb9277dedd56c6af7238

  • SHA1

    242ecbf5ca7c1299cbac51402550933c4f0bea59

  • SHA256

    7edfcf6bc8cdb53461ca26f9e01002405486fc1d3d53dec959825f9c460cd38a

  • SHA512

    1b8de98a97f2e587e9ecc961d91ef5af217a12210d24c9de00a97db1dcee785d1b850526ca77d686e6ec491dc1cc9fa2dcfd237604e23a2039d653daf13f2bd9

  • SSDEEP

    3072:mtYgtwCu+a9MMTb/OTlrjmPl3XymSPTTW6ulFoQea8OOm:gJa9MMf+m9nCTGkK8Pm

Score
7/10
persistence

Malware Config

Targets

    • Target

      rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe

    • Size

      176KB

    • MD5

      13997ebf7af8d37dda6697ac03f76cc3

    • SHA1

      9be2bcd498406bdfb05f860ad726273c4a7b4f3a

    • SHA256

      11ecf58db103eb2ded5b942f303d48b5d77e336b8edfe335fa7b81264d1f50ef

    • SHA512

      2894ef41ec784fb39ec663ff8ca5fa8c0ebbd875f95f6e2b843c8bca59d63cc7c43f64df43898290cef31c4b32478819f437fcc4656606d0f7cd4721c735ffee

    • SSDEEP

      3072:rGwR1qmB1TQgHtMF5a6I4Ya5Tlrjmvl3XymSPTyAAwoc9+IkMd+zr3/1C:7KLa6I4x3mdnCNAwo42M

    Score
    7/10
    persistence

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks