eed862ab8e60beeef9f63f298e397d51908074a3ba92f298df4f0858276c7ded | Triage

Sharing

General

Target

eed862ab8e60beeef9f63f298e397d51908074a3ba92f298df4f0858276c7ded
Size

130KB
Sample

221124-e1v2wscb71
MD5

3a0333fdf6a4a5c15bd3a405f4c4802e
SHA1

654fad8bf1efa518377fdf5eef01eb74c213dda0
SHA256

eed862ab8e60beeef9f63f298e397d51908074a3ba92f298df4f0858276c7ded
SHA512

9d9aa4ae28004798b0be664054bc0ebb7b64da497b23e30dbf7e397976f12d14d9f4989c32e44ec1b74aa2b461bfb17c245b478326d084c6841b98f4137dac04
SSDEEP

3072:MtYgtwCu+a9MMTb/OTlrjmPl3XymSPTTW6ulFoQea8OO4:yJa9MMf+m9nCTGkK8P4

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  rechnung_vodafone_de_2014_11_930370025_023870007_11_de_0000003837_888830.exe
- Size
  
  176KB
- MD5
  
  13997ebf7af8d37dda6697ac03f76cc3
- SHA1
  
  9be2bcd498406bdfb05f860ad726273c4a7b4f3a
- SHA256
  
  11ecf58db103eb2ded5b942f303d48b5d77e336b8edfe335fa7b81264d1f50ef
- SHA512
  
  2894ef41ec784fb39ec663ff8ca5fa8c0ebbd875f95f6e2b843c8bca59d63cc7c43f64df43898290cef31c4b32478819f437fcc4656606d0f7cd4721c735ffee
- SSDEEP
  
  3072:rGwR1qmB1TQgHtMF5a6I4Ya5Tlrjmvl3XymSPTyAAwoc9+IkMd+zr3/1C:7KLa6I4x3mdnCNAwo42M
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2