4bbb6ab157f92134a5c67ba3ca3232423cd92c47bcab312ea07a38b1a3ba96c4 | Triage

Sharing

General

Target

4bbb6ab157f92134a5c67ba3ca3232423cd92c47bcab312ea07a38b1a3ba96c4
Size

141KB
Sample

221124-ek4zvsfh38
MD5

0a108bb0555f9f17317c52e73919b048
SHA1

167293746e0d4954f2f7803f46c1074c246e2b01
SHA256

4bbb6ab157f92134a5c67ba3ca3232423cd92c47bcab312ea07a38b1a3ba96c4
SHA512

2af37e1f5200f2962f53092182264b22bf296b1ab0be76d98d23662b497bed9d85917512b389618022412359141b40357a9f07b5c487a59bf748df0f69972bab
SSDEEP

3072:MbAA3GZtUhxjGNC53yWMI++U4U9sd/ht+EEVnXWA3TZAy7Xw4:MbAqG3UTjfyU++VtthWjmyF

Score

7^/10

persistence

Malware Config

Targets

- Target
  
  Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe
- Size
  
  204KB
- MD5
  
  0fe1a6e23bb2accf9f57ba54b6002a2a
- SHA1
  
  e6b336b3e3b1d9043260b46bf5858a78ae114fd6
- SHA256
  
  58b48dc4fcff7d684c0a718a4475dc0b4b5ececa90b3d1e1092fccaf11399eb9
- SHA512
  
  c5ccc5c4eb739440a1a439a08e3725c0646e3653410b16b6c548b99c3fa3c8bb8fb074d180a158dddfc89ec102a373ed12f347446d2e401bc021beebb013850d
- SSDEEP
  
  3072:91FYqL5nh457wGZtUhxtGNC53yWMI++4V51iwhdlmBs1Z+cdn0t8+4I+VM:xYMw7wG3UTtfyU++Y51RldCh8+V+e
Score

7^/10

persistence
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2