99d6c5491d411bab9f4bc65c06d30edb94fa9502a7ed38460ae1acc0c398fbd7 | Triage

Sharing

General

Target

99d6c5491d411bab9f4bc65c06d30edb94fa9502a7ed38460ae1acc0c398fbd7
Size

141KB
Sample

221124-ek2jqsfh35
MD5

3bf675dcf147dad8cb5f905b64b8df50
SHA1

e020c966a23e10c4761ab8b1f633ab0348177aac
SHA256

99d6c5491d411bab9f4bc65c06d30edb94fa9502a7ed38460ae1acc0c398fbd7
SHA512

3dd4d0f2737deae65dd613e8ab94f4aeed8cd2813f30f37dab2ffd41c4a6d55a0763ee9849d9d80e7fcff15539074fd59262fd8d94e75e7b5ec4d7344710dfd6
SSDEEP

3072:dbAA3GZtUhxjGNC53yWMI++U4U9sd/ht+EEVnXWA3TZAy7XwD:dbAqG3UTjfyU++VtthWjmye

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
- Size
  
  204KB
- MD5
  
  0fe1a6e23bb2accf9f57ba54b6002a2a
- SHA1
  
  e6b336b3e3b1d9043260b46bf5858a78ae114fd6
- SHA256
  
  58b48dc4fcff7d684c0a718a4475dc0b4b5ececa90b3d1e1092fccaf11399eb9
- SHA512
  
  c5ccc5c4eb739440a1a439a08e3725c0646e3653410b16b6c548b99c3fa3c8bb8fb074d180a158dddfc89ec102a373ed12f347446d2e401bc021beebb013850d
- SSDEEP
  
  3072:91FYqL5nh457wGZtUhxtGNC53yWMI++4V51iwhdlmBs1Z+cdn0t8+4I+VM:xYMw7wG3UTtfyU++Y51RldCh8+V+e
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2