Overview

overview

7

Static

static

rechnung_n...89.exe

windows7-x64

7

rechnung_n...89.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a4e185a7b4a46ecd1a305b1dada207f845bd8a252b3458f9c4f722c82653611

  • Size

    135KB

  • Sample

    221124-e1nmtacb7s

  • MD5

    41014c219a2671d961738f05743acb6f

  • SHA1

    7be1bc65d0a909c69450f130449bf70c3be8155f

  • SHA256

    0a4e185a7b4a46ecd1a305b1dada207f845bd8a252b3458f9c4f722c82653611

  • SHA512

    d7a3d4ebbac6548352b31869ba17dc1c42577b1492329d70a653b11df065d2d513edece76990fbc6fb5ca1355829c4f80a8a5da8f40a8f9693bc077c21795185

  • SSDEEP

    3072:slLGJ4uuh6mqr3AQf/Kf2DWJEi/i8D2D7oyCT8nVn1QETaT2rewhp85QN8+n9:sla4zhaP/E2DH8yDTV1MT2re6p85QN39

Score
7/10
persistence

Malware Config

Targets

    • Target

      rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe

    • Size

      196KB

    • MD5

      03c97952e19ce93941404ef9a3a935f5

    • SHA1

      ec7edb6a0b5f14c7017ba645e269c8598633e384

    • SHA256

      e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0

    • SHA512

      713b638f2f4f0870798ae66e14a81de302612b8aec3dc4cb1ce169b6df9be3aa89746dae4b31b0cd98ada46bd0fda3e42c8b4992c04ef6635bd112a137339f7f

    • SSDEEP

      3072:9udusODvGZVHhX1drkr3k1qusMrf/Kf2DWJEi/i0D2D7oyCT8nVn1QJsYvVnGd+z:59+phXzpsML/E2DH0yDTV13Y5z

    Score
    7/10
    persistence

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks