b345e926bae71ebe1a10944a785cfa86e256278cb58ddba5ea425bd2d4f98db4 | Triage

Sharing

General

Target

b345e926bae71ebe1a10944a785cfa86e256278cb58ddba5ea425bd2d4f98db4
Size

141KB
Sample

221124-ek1x7sba61
MD5

f4453b573e4be6973217c587daea2f32
SHA1

924c8c0c88e8dcbbe49bc83bf48a58e87d464620
SHA256

b345e926bae71ebe1a10944a785cfa86e256278cb58ddba5ea425bd2d4f98db4
SHA512

86090e382ffbab9d5c1965faa3accb4f4e25a52457841264db82f4b4cb2444ad1dd8cc1249aa06d733110f32082ae3a20174a59c30515e7b7ddcf224493c7a1d
SSDEEP

3072:FbAA3GZtUhxjGNC53yWMI++U4U9sd/ht+EEVnXWA3TZAy7XwH:FbAqG3UTjfyU++VtthWjmye

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
- Size
  
  204KB
- MD5
  
  0fe1a6e23bb2accf9f57ba54b6002a2a
- SHA1
  
  e6b336b3e3b1d9043260b46bf5858a78ae114fd6
- SHA256
  
  58b48dc4fcff7d684c0a718a4475dc0b4b5ececa90b3d1e1092fccaf11399eb9
- SHA512
  
  c5ccc5c4eb739440a1a439a08e3725c0646e3653410b16b6c548b99c3fa3c8bb8fb074d180a158dddfc89ec102a373ed12f347446d2e401bc021beebb013850d
- SSDEEP
  
  3072:91FYqL5nh457wGZtUhxtGNC53yWMI++4V51iwhdlmBs1Z+cdn0t8+4I+VM:xYMw7wG3UTtfyU++Y51RldCh8+V+e
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2